How does DiGA approval at the BfArM work, so that your health app is listed in the directory?
We guide DiGA approval at the BfArM down both routes, from the eligibility assessment under Sec. 33a SGB V through study design to the application. The most common mistake comes before the application: a healthcare benefit not defined as a measurable endpoint from the start can hardly be proven.
Overview
How do you get into the DiGA directory: fast-track or regular?
Fast-track and regular procedure · Sec. 33a/Sec. 139e SGB V, DiGAV, MDR (EU 2017/745) Class I to IIb, BSI TR-03161
Last updated: October 9, 2026
A DiGA (Digital Health Application) is a medical app or piece of software listed by the German Federal Institute for Drugs and Medical Devices (BfArM) that is reimbursed by statutory health insurance under Sec. 33a SGB V.
- Two routes into the directory under Sec. 139e SGB V: permanent listing with an already proven positive healthcare effect, or provisional listing for a trial, for DiGA of the lower risk class. The trial period is initially up to twelve months and can be extended once by up to a further twelve months if the statutory conditions are met.
- Positive healthcare effect under the Digital Health Applications Ordinance (DiGAV): either a medical benefit or patient-relevant structural and procedural improvements, demonstrated quantitatively through a comparative study.
- Product status as the entry ticket: CE marking as a Class I, IIa or IIb medical device under EU 2017/745. For Class IIb, Sec. 139e(2) SGB V requires proof of a medical benefit, and provisional listing for a trial period is open only to Class I and IIa.
- Data protection and data security as objects of assessment: evidence per GDPR (EU 2016/679) and BSI TR-03161 is part of the BfArM procedure, not an afterthought.
- New obligations after permanent listing: the 2nd Amending Ordinance to the DiGAV governs the application-accompanying outcome measurement (AbEM). Manufacturers must collect usage data and the applicable patient-reported data in accordance with Sec. 23a to 23e DiGAV. The data are generally recorded quarterly and transmitted every six months. Staggered deadlines apply to the first transmission: usage data from 15 April 2027, survey data under Sec. 23d from 15 April 2028, and additional data under Sec. 23e from 15 April 2029. The obligation to collect patient-reported health status does not apply in the cases set out in Sec. 23a(1) DiGAV.
- Reimbursement after listing in the DiGA directory: when agreeing the reimbursement amount under Sec. 134(1) SGB V, at least 20 percent has had to be structured as performance-based price components since 1 January 2026. From 1 January 2027, volume-based discounts are additionally provided for, which, depending on the annual number of units dispensed, amount to at least 2 percent above 3,000 and at least 30 percent above 100,000 units.
Services
How we support you
Eligibility check & procedural strategy
Documented eligibility assessment against the DiGA criteria under Sec. 33a SGB V: MDR risk class, intended purpose and recognizable healthcare effect, with a justified recommendation for the fast-track or the regular procedure. On request including a review of the DiPA option under Sec. 40a SGB XI.
Study design for the positive healthcare effect
Evaluation concept with endpoints, comparator group and study type per the DiGAV requirements, tailored to the chosen effect category: medical benefit or patient-relevant structural and procedural improvement.
Data protection & data security audit
Pre-audit per BSI TR-03161 with a documented gap list, alignment against the GDPR (EU 2016/679) and the build-out of ISO/IEC 27001 components, so that the evidence is in place before submission rather than during the deficiency-request process.
BfArM consultation & AbEM preparation
Preparation and support for the consultation with the BfArM, and support in drawing up the scientific evaluation concept for provisional listing under Sec. 139e(4) SGB V. For DiGA intended for permanent listing, we advise on the requirements for the application-accompanying outcome measurement (AbEM), including the required data categories, collection processes and reporting deadlines.
How we work together
What it comes down to
A DiGA must pass three assessment logics at once, each drawn from a different body of rules. First, it is a medical device in Class I, IIa or IIb with CE marking under EU 2017/745. Second, it is a system that demonstrably meets data protection and data security requirements under the GDPR (EU 2016/679) and BSI TR-03161.
Third, a DiGA is a statutory health insurance benefit under Sec. 33a SGB V whose positive healthcare effect must be demonstrated quantitatively.
The first two strands, medical device status and data protection, can be worked through. The bottleneck is almost always the third, the healthcare effect: one that was not defined as a measurable endpoint with a suitable comparator group from the outset can hardly be demonstrated after the fact.
The requirements for demonstrating positive healthcare effects dictate a clear sequence: first, risk class, intended purpose and the healthcare effect to be demonstrated are examined. Then the procedural strategy is set. For an application for permanent listing, the required evidence of benefit must already be available. With provisional listing, the evidence is generated during the trial period on the basis of a scientific evaluation concept. The trial is initially limited to twelve months and can be extended only if the statutory conditions are met.
After permanent listing, DiGA are subject to the requirements for the application-accompanying outcome measurement under Sec. 23a to 23e DiGAV. The required data must be collected in accordance with the applicable rules and transmitted to the BfArM within the staggered reporting deadlines. Distinct from this are the reimbursement rules under Sec. 134(1) SGB V: since 1 January 2026, at least 20 percent of the agreed reimbursement amount has had to be structured as performance-based price components.
If the evidence strategy is only settled after the application, every correction falls into the trial period, where time runs against the product.
| Feature | DiGA | DiPA |
|---|---|---|
| Legal basis | Sec. 139e SGB V | Sec. 40a SGB XI |
| Benefit area | treating an illness | care |
| Payer | Statutory health insurance (Sec. 33a SGB V) | Long-term care insurance |
Our approach
Our approach
Step
Result
Eligibility check
Assessed DiGA eligibility: MDR risk class, intended purpose and alignment against Sec. 33a SGB V, with a recommendation for the fast-track or the regular procedure.
Define the healthcare effect
Defined positive healthcare effect with measurable endpoints, assigned to a recognized DiGAV category.
Data protection & data security
Audit report per BSI TR-03161 with a gap list and completed measures ahead of submission.
Study or evaluation concept
Evaluation concept with comparator group and endpoints per DiGAV, in the fast-track as a scientific evaluation concept from a manufacturer-independent institution under Sec. 139e(4) SGB V.
BfArM consultation & application
Completed pre-submission consultation with the BfArM and a fully submitted application with all required evidence.
Review & listing
Listing in the DiGA directory; with provisional listing, the trial study as the route to final listing, and after permanent listing the application-accompanying outcome measurement.
Common pitfalls
Where projects commonly fail
The wrong procedure was chosen.
The regular route without sufficient preliminary studies ends in formal rejection; the fast-track without a viable evaluation concept burns through the trial period of initially up to twelve months without producing usable evidence at the end.
The healthcare effect is not defined in a way the BfArM can accept.
Endpoints that qualify neither as a medical benefit nor as a patient-relevant structural and procedural improvement within the meaning of the DiGAV lead to rejection, no matter how methodologically sound the study is.
The MDR classification is underestimated.
Software that provides information for diagnostic or therapeutic decisions quickly slips into Class IIb under Rule 11 in MDR Annex VIII. It then stays reimbursable only with proof of a medical benefit and without a trial period, and in Class III the route into the DiGA directory is closed.
Data security comes too late.
Applications regularly fail on the BSI requirements; building out the evidence per BSI TR-03161 only after submission generates deficiency requests and loses months in the procedure.
The application-accompanying outcome measurement is prepared too late.
Manufacturers of permanently listed DiGA must collect the usage data and, where applicable, survey data required under Sec. 23a to 23e DiGAV and transmit them to the BfArM within the respective deadlines. The BfArM publishes the relevant results under the conditions of Sec. 20(4) DiGAV. Failing to prepare the required collection processes in time risks non-compliance with the reporting obligations.
Regulatory Affairs
Do any of these pitfalls apply to you?
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Frequently asked questions
Sources
- Sec. 33a SGB V and Sec. 139e SGB V: Digital health applications, the DiGA directory and the procedure at the BfArM
- Digital Health Applications Ordinance (DiGAV) incl. 2nd Amending Ordinance, effective since 01.02.2026
- Second Ordinance amending the Digital Health Applications Ordinance of 27 January 2026, BGBl. 2026 I No. 22, Article 1 items 5 and 11 (Section 6a, Secs. 23a to 23e DiGAV): https://www.recht.bund.de/eli/bund/bgbl-1/2026/22
- Digital Act (DigiG) of 22 March 2024, BGBl. 2024 I No. 101, Article 1 item 4 (Sec. 33a SGB V: medical devices of the higher risk Class IIb): https://www.recht.bund.de/eli/bund/bgbl-1/2024/101
- Sec. 134(1) SGB V (performance-based price components, volume-based discount under the GKV Contribution Rate Stabilisation Act, BGBl. 2026 I No. 228, Article 1 item 55): primary text, gesetze-im-internet.de
- BSI TR-03161: Requirements for applications in the healthcare sector
- Regulation (EU) 2017/745 (MDR), Annex VIII (classification rules)
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Projects from this industry
What we have worked on in this industry
Related insights
All insights →Regulations & standards considered
- Sec. 33a SGB V (Digital Health Applications)
- Sec. 139e SGB V (DiGA directory and BfArM procedure)
- Sec. 134 SGB V (Reimbursement amounts for DiGA)
- Sec. 40a SGB XI (Digital Care Applications, DiPA)
- Digital Health Applications Ordinance (DiGAV), incl. 2nd Amending Ordinance (effective since 01.02.2026)
- EU 2017/745 (MDR), Annex VIII Rule 11
- EU 2016/679 (GDPR)
- EU 2024/1689 (AI Act)
- BSI TR-03161 (Requirements for applications in the healthcare sector)
- ISO/IEC 27001 (Information security management systems)
Related topics
MDR Conformity →
CE marking under EU 2017/745 as the prerequisite for any DiGA
EU AI Act →
Additional requirements under EU 2024/1689 (AI Act) for AI-supported DiGA
Clinical Compliance →
Plan and generate clinical evidence for the healthcare effect in a compliant way
Regulatory Affairs →
Strategic market access beyond the DiGA listing
MedTech & IVD Reimbursement →
The other reimbursement routes for medical devices besides the DiGA directory
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences