Medical Apps and DiGA Development

A good UI/UX is one of the major technical requirements for DiGAs, as it is imperative that they are user-friendly. DiGAs need to fulfill the main principles and requirements of usability and accessibility. The user interface needs to be clear and intuitive to give patients full control over the application. Each DiGA needs to be designed to address the needs of a specific population group or patients with specific conditions. Each DiGA also needs to have a relevant user interface for better patient outcomes.

In order to become a DiGA, health apps need to present health data using an open, internationally recognized interoperability standard called FHIR (Fast Healthcare Interoperability Resources) to ensure digital exchange of patient data. To be approved by BfArM for interoperability, DiGA providers might need to consult with a technology partner that has enough expertise implementing FHIR solutions. Achieving interoperability is a challenge, but successful implementation can be a significant advantage in making your DiGA compatible on the market.

DiGA providers need to integrate their applications with insurance companies that provide coverage in order to generate invoices. Currently, the application programming interfaces (APIs) provided by insurance companies have poor coverage of necessary integrations and often require DiGA providers to deal with issues such as technical debts and mistakes in calculations. To successfully integrate with the insurance ecosystem, DiGA providers might want to bring on a third-party service provider that has expertise and experience with these kinds of integrations.

The Federal Ministry of Health requires DiGA manufacturers to provide data security and data protection at all times. To ensure data protection and security, the BSI (Office for Information Security) has developed guidelines that ensure confidentiality, integrity, and availability. BSI developed these regulations to make sure that DiGAs meet requirements for information security. This includes security regulations for the purpose of use, the architecture, source code, third-party software, encryption and authentication, data protection, chargeable resources, and security regulations for network communication and resilience.

In accordance with German data protection laws, data that is collected by DiGAs can not be transferred outside the EU. DiGA providers that use US cloud providers or data centers, such as AWS or Microsoft Azure, must migrate data to local data centers. This migration is often more intensive than simply transferring data from one system to another. Digital health applications are tightly integrated with cloud providers’ services for authorization/ authentication, analytics, and other data operating mechanisms. That data must be transitioned, as well.