Apply for inclusion of a digital health application (DiGA) in the DiGA directory

Since the Digital Healthcare Act (DVG) came into force, people insured under the statutory health insurance scheme (GKV) have been entitled to be provided with digital health applications (DiGA). These are, for example, medical health apps that can be prescribed by doctors and psychotherapists and are reimbursed by the health insurance fund. These are exclusively medical devices in risk classes I, IIa or IIb.

The prerequisite for this is that

• the DiGA must have successfully passed a test procedure at the Federal Institute for Drugs and Medical Devices (BfArM) and
• are listed in the "Directory of reimbursable digital health applications" (DiGA directory).

Only you as the manufacturer of the medical device or a person authorized by you can submit an application for inclusion in the directory. Inclusion in the BfArM directory is a prerequisite for reimbursement as part of the standard care provided by statutory health insurance (SHI).

The procedure is designed as a fast-track process: The BfArM usually evaluates the complete application within 3 months. Only in justified individual cases can the deadline be extended by up to a further 3 months. If there is sufficient evidence of positive treatment effects, the product is permanently included in the DiGA directory. If there is not yet sufficient evidence of the positive effects on care, an application for provisional inclusion can be submitted. The trial period is a maximum of 12 months. During this period, data can be collected, for example as part of clinical trials. In exceptional cases, this period can also be extended by a further 12 months.

However, when planning the extended trial period, the three-month evaluation period of the submitted evidence by the BfArM must be taken into account. Accordingly, proof of the positive supply effect must be submitted at least 3 months before the end of the extended trial period. This ensures that the duration of the trial period is limited to a maximum of 24 months in the event of an extension.

If you require support from the BfArM, you can arrange a consultation appointment with the Institute. The BfArM will advise you on the requirements for inclusion in the DiGA directory in order to support you at an early stage in generating meaningful documents and data for inclusion.

Requirements

To be listed in the directory, a DiGA must fulfill the following requirements:

• Security and functionality,
• data protection and information security,
• quality, in particular interoperability, and
• proof of positive supply effects, depending on the type of application.

What documents do I need?

• Power of attorney of an authorized person to submit the application, if applicable
• Declaration of conformity
• CE certificate, if applicable
• Certificate on the implementation of an information security management system (ISMS) according to ISO 27001 or according to ISO 27001 on the basis of IT-Grundschutz (BSI standard 200-2: IT-Grundschutz methodology)
• Proof that a penetration test has been carried out and that the vulnerabilities found have been remedied
• Instructions for use
• Study(s) to demonstrate positive effects on care or results of a systematic data analysis to justify the improvement in care (study protocol, study report)
• Scientific evaluation concept, if applicable
• Study to determine the test accuracy of the diagnostic instruments contained in the DiGA (if applicable)
• Minutes of the consultation with the BfArM (if applicable)
• Disclosure of data where legal requirements for the protection of trade and business secrets or the protection of personal data or intellectual property preclude publication
• Further documents, if further evidence is requested by the BfArM as part of the review