{"id":5909,"date":"2026-04-10T09:15:56","date_gmt":"2026-04-10T07:15:56","guid":{"rendered":"https:\/\/www.bayoomed.com\/news\/help-i-have-a-diga-technical-implementation-and-requirements\/"},"modified":"2026-04-10T09:52:04","modified_gmt":"2026-04-10T07:52:04","slug":"help-i-have-a-diga-technical-implementation-and-requirements","status":"publish","type":"news","link":"https:\/\/www.bayoomed.com\/en\/news\/help-i-have-a-diga-technical-implementation-and-requirements\/","title":{"rendered":"Help, I have a DiGA – Technical implementation and requirements"},"content":{"rendered":"

The technical guide for DiGA manufacturers: <\/strong>From health insurance billing to ePA integration<\/strong><\/h2><\/h2><\/div>

Author: Alexandra Heuel <\/strong>Project Manager at BAYOOMED<\/p>\n<\/div>

Have you developed an app that is already a medical device – or are you planning to build a DiGA from scratch? Then the most challenging part begins now: the implementation.<\/p>\n

Because a DiGA is not a classic software product. In addition to the actual application, you need a resilient backend architecture, secure authentication, clean data processes, interfaces to health insurance companies and – in the long term – a connection to the telematics infrastructure.<\/p>\n

This guide shows you which technical components are relevant, how they are connected and what you should pay attention to in practice.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

Why develop a DiGA?<\/h2><\/h2><\/div>

If a DiGA is prescribed by a doctor, statutory health insurance companies cover the costs and reimburse them directly to the manufacturer. In the case of private health insurance companies, reimbursement is based on individual contracts. However, the prerequisite for this is always that the DiGA must first be successfully tested and included in the official list of the BfArM.<\/p>\n

The DiGA process is considered one of the most advanced reimbursement processes for digital health applications in Europe. For manufacturers, it opens up the opportunity to improve care and at the same time use a clearly defined commercial access route into the healthcare system.<\/p>\n<\/div>

\"DiGA_Entwicklung\"<\/span><\/div>

Legal basis for DiGA<\/h2><\/h2><\/div>

The legal basis for DiGA can be found in \u00a7 33a SGB V. Further requirements are regulated in the DiGAV. The BfArM test criteria and the BfArM’s public information<\/a> are also relevant.<\/p>\n

The DiGA guidelines of the BfArM<\/a> also provide important orientation.<\/p>\n

The BfArM examines a DiGA and includes it in the list if the specified requirements are met.<\/p>\n<\/div>

Requirements for manufacturers<\/h2><\/h2><\/div>

In addition to the requirements for the application itself, manufacturers must also meet certain formal requirements. In particular, this includes a quality management system in accordance with ISO 13485<\/strong>. The manufacturer must also provide evidence of an information security management system with certification in accordance with ISO 27001<\/strong> or ISO 27001 based on IT baseline protection<\/strong>. Since April 1, 2022<\/strong>, the BfArM has required a corresponding ISMS certificate from the manufacturer for DiGA; since January 1, 2025<\/strong>, a certificate based on TR-03161 has also been required to prove the data security of the application.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

Information security: Why TR-03161 is important for DiGA<\/strong><\/h2><\/h3><\/div>

Information security is a central component of every DiGA. BSI TR-03161 defines requirements for the protection of sensitive healthcare data – for example in relation to authentication, encryption and secure data processing.<\/p>\n

To be included in the DiGA directory, the manufacturer must prove that the relevant security requirements have been implemented by means of a certificate from the BSI. The aim of these requirements is to effectively protect patient data and ensure the trustworthy use of digital health applications.<\/p>\n<\/div>

How the test typically works<\/strong><\/h3><\/h3><\/div>

The audit is carried out by recognized inspection bodies such as PwC, T\u00dcV Informationstechnik or Secuvera.<\/p>\n

Important for planning:<\/p>\n