The Technical Guideline TR-03161 contains detailed requirements for applications in the healthcare sector, in particular for digital health applications (DiGA).
\nThe aim of this guideline is to provide DiGA manufacturers with a comprehensive guide to implementing secure solutions.
\nBecause DiGAs store sensitive and personal data, compliance with a high security standard is essential. <\/p>\n<\/div><\/div><\/div><\/div><\/div>
TR-03161 is divided into several documents that focus on different types of applications:<\/p>\n<\/div><\/div><\/div>
Mobile applications<\/p><\/h4><\/div><\/div><\/div>
Web applications<\/p><\/h4><\/div><\/div><\/div>
Background systems<\/p><\/h4><\/div><\/div><\/div>
These documents contain a large number of test aspects that are divided into different areas.
\nThe guideline not only describes the methodology of the test, but also provides detailed test characteristics for each aspect. <\/p>\n
These test characteristics explain how the requirements are evaluated by testers.
\nThe topics range from checking the source code and data architecture to authenticating users and securely setting up the necessary infrastructure and communication between the systems. <\/p>\n
There are currently only a few test centers that can carry out TR-03161 tests.<\/p>\n<\/div><\/div><\/div><\/div><\/div>
DiGA manufacturers must recognize at an early stage which requirements have already been met and where there is still a need for action.
\nThe first step is to carry out a GAP analysis to document the current status.
\nThis enables them to take targeted measures to close gaps. <\/p>\n
All requirements should be documented and traceable.
\nThis makes it easier for both manufacturers and inspectors to assess whether all aspects have been met. <\/p>\n
According to the specifications of the Federal Institute for Drugs and Medical Devices (BfArM), certification in accordance with TR-03161 must be available by January 1, 2025 at the latest.
\nEarly preparation for testing and certification is therefore crucial and should be planned in good time. <\/p>\n<\/div><\/div><\/div>
TR-03161 brings some important changes and requirements for manufacturers of DiGA and healthcare applications:<\/p>\n<\/div>
AUTHENTICATION<\/strong><\/p>\n<\/header>\n Among other things, two-factor authentication and re-authentication are required for certain app functions.<\/p>\n<\/div>\n<\/div>\n<\/div><\/li> USER ACCOUNT<\/b><\/p>\n<\/header>\n SAFETY INSTRUCTIONS<\/b><\/p>\n<\/header>\n If insecure login procedures are used, a corresponding dialog must be displayed to inform the user of the insecurity. USABILITY<\/b><\/p>\n<\/header>\n Some measures may impair user-friendliness, but are necessary to ensure security.<\/p>\n<\/div>\n<\/header>\n<\/div>\n<\/div>\n<\/div><\/li> DEVICE INFORMATION<\/b><\/p>\n<\/header>\n Customers are informed about the use of unsafe devices.<\/p>\n<\/div>\n<\/header>\n<\/div>\n<\/div>\n<\/div><\/li> USER SESSIONS AND CONSENTS<\/b><\/p>\n<\/header>\n There are detailed guidelines for viewing user sessions and obtaining consent within the DiGA.<\/p>\n<\/div>\n<\/header>\n<\/div>\n<\/div>\n<\/div><\/li> STORAGE AND COMMUNICATION<\/b><\/p>\n<\/header>\n The requirements for the storage and communication of user data are much stricter.<\/p>\n<\/div>\n<\/header>\n<\/div>\n<\/div>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
\nCustomers should keep their DiGA codes for any long prescription periods (up to 12 months). <\/div>\n<\/header>\n<\/div>\n<\/div><\/li>
\nThis also applies to widely used biometric authentication methods. <\/p>\n<\/div>\n<\/header>\n<\/div>\n<\/div>\n<\/div><\/li>