How does DiGA approval at the BfArM work, so that your health app is listed in the directory?
We guide DiGA approval at the BfArM down both routes, from the eligibility assessment under Sec. 33a SGB V through study design to the application. The most common mistake comes before the application: a healthcare benefit not defined as a measurable endpoint from the start can hardly be proven.
Overview
How do you get into the DiGA directory: fast-track or regular?
Fast-track and regular procedure · Sec. 33a/Sec. 139e SGB V, DiGAV, MDR (EU 2017/745) Class I to IIb, BSI TR-03161
Last updated: October 3, 2026
A DiGA (Digital Health Application) is a medical app or piece of software listed by the German Federal Institute for Drugs and Medical Devices (BfArM) that is reimbursed by statutory health insurance under Sec. 33a SGB V.
- Two routes into the directory under Sec. 139e SGB V: the regular procedure with an already proven healthcare effect, or provisional listing (fast-track) with a 12-month trial period during which the evidence is supplied.
- Positive healthcare effect under the Digital Health Applications Ordinance (DiGAV): either a medical benefit or patient-relevant structural and procedural improvements, demonstrated quantitatively through a comparative study.
- Product status as the entry ticket: CE marking as a Class I, IIa or IIb medical device under EU 2017/745. For Class IIb, Sec. 139e(2) SGB V requires proof of a medical benefit, and provisional listing for a trial period is open only to Class I and IIa.
- Data protection and data security as objects of assessment: evidence per GDPR (EU 2016/679) and BSI TR-03161 is part of the BfArM procedure, not an afterthought.
- New obligations after listing since 01.02.2026: the 2nd Amending Ordinance to the DiGAV governs the application-accompanying outcome measurement (AbEM) for permanently listed DiGA. Usage volume, usage frequency and discontinuation are collected each quarter, plus patient satisfaction and health status by survey (the latter does not apply where the evidence rested solely on a study of structural and procedural improvements); data are transmitted twice a year, first by 15 April 2027.
- Reimbursement with a performance-based share: under Sec. 134(1) SGB V, at least 20 percent of the reimbursement amount has had to be performance-based since 2026. From 2027 a volume-based discount is added, at least 2 percent above 3,000 and at least 30 percent above 100,000 units dispensed per year.
Services
How we support you
Eligibility check & procedural strategy
Documented eligibility assessment against the DiGA criteria under Sec. 33a SGB V: MDR risk class, intended purpose and recognizable healthcare effect, with a justified recommendation for the fast-track or the regular procedure. On request including a review of the DiPA option under Sec. 40a SGB XI.
Study design for the positive healthcare effect
Evaluation concept with endpoints, comparator group and study type per the DiGAV requirements, tailored to the chosen effect category: medical benefit or patient-relevant structural and procedural improvement.
Data protection & data security audit
Pre-audit per BSI TR-03161 with a documented gap list, alignment against the GDPR (EU 2016/679) and the build-out of ISO/IEC 27001 components, so that the evidence is in place before submission rather than during the deficiency-request process.
BfArM pre-submission consultation & outcome measurement
Preparation and support for the pre-submission consultation with the BfArM, in the fast-track with the scientific evaluation concept for the trial under Sec. 139e(4) SGB V, and setup of the data collection for the application-accompanying outcome measurement (AbEM), which is collected quarterly and transmitted to the BfArM twice a year after permanent listing.
How we work together
What it comes down to
A DiGA must pass three assessment logics at once, each drawn from a different body of rules. First, it is a medical device in Class I, IIa or IIb with CE marking under EU 2017/745. Second, it is a system that demonstrably meets data protection and data security requirements under the GDPR (EU 2016/679) and BSI TR-03161.
Third, a DiGA is a statutory health insurance benefit under Sec. 33a SGB V whose positive healthcare effect must be demonstrated quantitatively.
The first two strands, medical device status and data protection, can be worked through. The bottleneck is almost always the third, the healthcare effect: one that was not defined as a measurable endpoint with a suitable comparator group from the outset can hardly be demonstrated after the fact.
This evidence problem around the healthcare effect dictates the sequence: first the eligibility check covering risk class, intended purpose and a recognizable healthcare effect, then the choice of procedure between fast-track and the regular route, and only after that the application and the study.
The 12-month trial period of provisional listing forgives no methodological corrections. After permanent listing, the DiGAV amendment of 01.02.2026 adds the application-accompanying outcome measurement: usage and survey data are collected quarterly and transmitted to the BfArM twice a year, and since 2026 at least 20 percent of the reimbursement amount has to be agreed as performance-based.
Settle the evidence strategy only after the application, and every correction falls into the trial period, where time runs against the product.
| Feature | DiGA | DiPA |
|---|---|---|
| Legal basis | Sec. 139e SGB V | Sec. 40a SGB XI |
| Benefit area | treating an illness | care |
| Payer | Statutory health insurance (Sec. 33a SGB V) | Long-term care insurance |
Our approach
Our approach
Step
Result
Eligibility check
Assessed DiGA eligibility: MDR risk class, intended purpose and alignment against Sec. 33a SGB V, with a recommendation for the fast-track or the regular procedure.
Define the healthcare effect
Defined positive healthcare effect with measurable endpoints, assigned to a recognized DiGAV category.
Data protection & data security
Audit report per BSI TR-03161 with a gap list and completed measures ahead of submission.
Study or evaluation concept
Evaluation concept with comparator group and endpoints per DiGAV, in the fast-track as a scientific evaluation concept from a manufacturer-independent institution under Sec. 139e(4) SGB V.
BfArM consultation & application
Completed pre-submission consultation with the BfArM and a fully submitted application with all required evidence.
Review & listing
Listing in the DiGA directory; with provisional listing, the trial study as the route to final listing, and after permanent listing the application-accompanying outcome measurement.
Common pitfalls
Where projects commonly fail
The wrong procedure was chosen.
The regular route without sufficient preliminary studies ends in formal rejection; the fast-track without a viable evaluation concept burns through the 12-month trial period without producing usable evidence at the end.
The healthcare effect is not defined in a way the BfArM can accept.
Endpoints that qualify neither as a medical benefit nor as a patient-relevant structural and procedural improvement within the meaning of the DiGAV lead to rejection, no matter how methodologically sound the study is.
The MDR classification is underestimated.
Software that provides information for diagnostic or therapeutic decisions quickly slips into Class IIb under Rule 11 in MDR Annex VIII. It then stays reimbursable only with proof of a medical benefit and without a trial period, and in Class III the route into the DiGA directory is closed.
Data security comes too late.
Applications regularly fail on the BSI requirements; building out the evidence per BSI TR-03161 only after submission generates deficiency requests and loses months in the procedure.
Outcome measurement is planned only after listing.
Since the 2nd Amending Ordinance to the DiGAV of 01.02.2026, manufacturers of permanently listed DiGA report usage and survey data to the BfArM, which publishes them in the directory, and under Sec. 134(1) sentence 6 SGB V the results are also transmitted to the GKV-Spitzenverband (National Association of Statutory Health Insurance Funds). Without data collection built into the product, the reporting deadlines are missed.
Regulatory Affairs
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
Sources
- Sec. 33a SGB V and Sec. 139e SGB V: Digital health applications, the DiGA directory and the procedure at the BfArM
- Digital Health Applications Ordinance (DiGAV) incl. 2nd Amending Ordinance, effective since 01.02.2026
- Second Ordinance amending the Digital Health Applications Ordinance of 27 January 2026, BGBl. 2026 I No. 22, Article 1 items 5 and 11 (Section 6a, Secs. 23a to 23e DiGAV): https://www.recht.bund.de/eli/bund/bgbl-1/2026/22
- Digital Act (DigiG) of 22 March 2024, BGBl. 2024 I No. 101, Article 1 item 4 (Sec. 33a SGB V: medical devices of the higher risk Class IIb): https://www.recht.bund.de/eli/bund/bgbl-1/2024/101
- Sec. 134(1) SGB V (performance-based price components, volume-based discount under the GKV Contribution Rate Stabilisation Act, BGBl. 2026 I No. 228, Article 1 item 55): primary text, gesetze-im-internet.de
- BSI TR-03161: Requirements for applications in the healthcare sector
- Regulation (EU) 2017/745 (MDR), Annex VIII (classification rules)
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Projects from this industry
What we have worked on in this industry
Related insights
All insights →Regulations & standards considered
- Sec. 33a SGB V (Digital Health Applications)
- Sec. 139e SGB V (DiGA directory and BfArM procedure)
- Sec. 134 SGB V (Reimbursement amounts for DiGA)
- Sec. 40a SGB XI (Digital Care Applications, DiPA)
- Digital Health Applications Ordinance (DiGAV), incl. 2nd Amending Ordinance (effective since 01.02.2026)
- EU 2017/745 (MDR), Annex VIII Rule 11
- EU 2016/679 (GDPR)
- EU 2024/1689 (AI Act)
- BSI TR-03161 (Requirements for applications in the healthcare sector)
- ISO/IEC 27001 (Information security management systems)
Related topics
MDR Conformity →
CE marking under EU 2017/745 as the prerequisite for any DiGA
EU AI Act →
Additional requirements under EU 2024/1689 (AI Act) for AI-supported DiGA
Clinical Compliance →
Plan and generate clinical evidence for the healthcare effect in a compliant way
Regulatory Affairs →
Strategic market access beyond the DiGA listing
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +41 61 271 23 80
info@theentourage.ch
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences