Insights  /  Digital health · DiGA
Digital health · Germany

The DiGA fast-track: getting a health app prescribed

Germany is the only major market with a national route to have a digital health application prescribed by doctors and reimbursed by statutory insurance. The BfArM fast-track decides in 90 days — but a listing is not a prescription, and 2026 tied a fifth of your price to outcomes. This is the full map.

12 min read By Alexander Baranov, Commercial & Partnerships Lead Updated 2026
In one paragraph

A DiGA (Digitale Gesundheitsanwendung) is a low-risk medical-device app that Germany's statutory insurers reimburse when a doctor prescribes it. You reach it through the BfArM fast-track: submit a complete application and BfArM decides on directory inclusion within 90 days. Two doors: permanent listing if you already prove a positive care effect, or provisional listing with a trial period (up to 12 months, extendable) to generate the evidence. Eligibility covers low-risk devices — Class I and IIa, and from 2026 Class IIb. You set the price for the first year, then negotiate with the GKV-Spitzenverband; since January 2026 at least 20% of the reimbursement must be tied to outcomes (AbEM). Data security is hard-gated: the BSI TR-03161 certificate is mandatory. And the catch under everything: a directory listing makes you reimbursable, not prescribed.

A route that exists nowhere else

Most markets have no structured way to reimburse a health app. Germany built one — and for a lean software company it can be the most capital-efficient path into healthcare revenue anywhere.

The DiGA framework, created by the Digitale-Versorgung-Gesetz in 2019, lets a qualifying app be entered in the BfArM directory, prescribed by physicians and psychotherapists, and reimbursed by statutory health insurance — which covers roughly 90% of the population. No FDA-style device clearance in the US, and no national market in the UK or France, offers the same combination of a fixed process and a guaranteed payer.

That is the opportunity. The rest of this guide is the reality: who qualifies, how the 90-day fast-track works, the two listing routes, the evidence bar, how pricing now works after the 2026 outcome-based reform, the data-security gate, and the commercial catch that turns a listing into revenue — or doesn't.

Germany will list your app in 90 days. Getting it prescribed is the year that follows.

Does your app qualify as a DiGA?

Not every health app is a DiGA. The definition is specific, and getting it wrong wastes the whole application.

A DiGA is a low-risk medical device whose main function is digital, that supports the detection, treatment or management of a disease (or an injury or disability), and that is used by the patient — or by patient and provider together. In practice that means:

  • A CE-marked medical device in the low-risk classes — Class I or IIa under the MDR, and, from 2026, extended to Class IIb. Confirm your class first; see MDR vs IVDR.
  • A digital core. The medical purpose is achieved mainly through the software's digital function, not hardware.
  • Patient-facing. The patient uses it, alone or with their provider.
  • A credible positive care effect — the outcome you will prove, discussed below.

Pure fitness, wellness or lifestyle apps do not qualify. Nor do apps that are only used by professionals. There is a sibling route, the DiPA (digital care applications), for the long-term care setting.

The sequence

The BfArM fast-track, step by step

The "fast" in fast-track is the 90-day review. The work that decides success happens before you file — and after you list.

01

Meet the prerequisites

CE mark in the eligible class, GDPR-compliant data handling, and the BSI data-security certificate. These are gates, not nice-to-haves.Before you file

02

Choose your route

Apply for permanent listing if you can already prove a positive care effect, or provisional listing to enter the directory while you generate the evidence in a trial period.

03

Submit and clear the 90-day review

Once your application is complete, BfArM must decide on directory inclusion within 90 days — assessing safety, quality, data protection, data security and the care-effect evidence or study plan.

04

Listing in the DiGA directory

Inclusion makes the app prescribable and reimbursable across statutory insurance. Provisional entries carry a deadline to deliver the evidence.Reimbursable, not yet prescribed

05

Price negotiation with the GKV-SV

You set the price for roughly the first year; then a reimbursement amount is negotiated with the National Association of Statutory Health Insurance Funds, with arbitration if needed.

06

Prescription & uptake

Physicians and psychotherapists prescribe it; patients redeem it with their insurer. This is where the real commercial work begins.

Provisional vs permanent listing

The two doors into the directory are the most important strategic choice in a DiGA application — they trade evidence maturity against speed to revenue.

 Provisional listing (vorlaeufig)Permanent listing
Evidence at entryA plausible positive care effect + a study planA proven positive care effect
Trial periodTypically up to 12 months (extendable) to deliver the studyNone — evidence already in
Reimbursed fromDirectory entry, during the trialDirectory entry
RiskRemoved from the directory if the effect isn't proven in timeLower — but slower and costlier to reach
Best forGetting to revenue early while evidence maturesProducts with a completed comparative study

Most first-time DiGA manufacturers enter provisionally — the point of the framework is to let a real-world study run while the product is already reimbursed. But the trial-period deadline is real: fail to prove the effect and the app leaves the directory.

The positive-care-effect bar

Everything turns on the positiver Versorgungseffekt — the positive care effect. It is what earns permanent listing and, increasingly, what your price depends on.

A positive care effect is one of two things: a medical benefit (for example an improvement in health status, disease duration, survival or quality of life), or a patient-relevant improvement in structure and process of care (such as better adherence, health literacy, coordination or reduced treatment burden). You choose which you claim, and you prove it — normally through a comparative study conducted in Germany or transferable to the German care context.

Medical benefit

A measurable clinical improvement — outcomes, symptoms, quality of life. Usually the stronger claim for negotiation, and harder to evidence.

Higher bar, stronger price case

Structural / procedural improvement

Better adherence, literacy, access or coordination. Often faster to demonstrate, and a legitimate route to permanent listing.

Pragmatic, still defensible

Design the study before you file, not after. The comparator, endpoint and population you choose are what BfArM assesses and what later anchors the price — the same logic that governs medicines under AMNOG.

Pricing — and the 2026 outcome rule

DiGA pricing mirrors AMNOG in shape: a free launch price, then a negotiated one. The 2026 reform added a twist that changes how you build the business case.

For roughly the first year after listing, you set your own price. Reported launch prices have run widely — often in the low hundreds of euros per three-month prescription — and typically fall by around half after negotiation or arbitration with the GKV-Spitzenverband. So the number to model is the negotiated price, not the launch price.

The structural change: since 1 January 2026, at least 20% of the reimbursement must be tied to outcomes — a performance-linked component measured through application-accompanying success measurement (AbEM). In plain terms, a fifth of your revenue now depends on the app demonstrably working in routine use, not just on being listed.

What the outcome rule means

Your evidence engine has to keep running after launch

Outcome-linked pricing turns success measurement from a one-off listing exercise into a permanent operational capability. You need to capture the agreed outcome parameters in live use, reliably, for as long as you are reimbursed — and build the downside into your revenue model from day one.

This is the DiGA face of the thesis we apply everywhere: being listed and reimbursable is not the same as being paid in full. See authorized isn't paid.

The data-security gate

For a health app handling patient data, this is the hurdle non-German teams most underestimate — and it is a hard gate, not a scoring factor.

  • GDPR for all personal and health data — the baseline, and stricter than US norms.
  • BSI TR-03161 — the German Federal Office for Information Security's data-security requirements, evidenced per DiGA and now mandatory. No certificate, no listing.
  • ISO 27001 — an information-security management system at company level is required.
  • Data-protection requirements specific to the DiGA framework, verified by BfArM.

Budget the security programme early; retrofitting TR-03161 onto a finished product is slow and expensive. We cover the wider hurdle in data security for digital health.

Listed is not prescribed

The single most expensive DiGA assumption is that the directory is the finish line. It is the starting line for the commercial work.

A directory listing makes your app reimbursable. It does not make a single doctor prescribe it, or a single patient use it. Prescription uptake depends on physician awareness, a simple prescribing workflow, patient activation and real-world adherence — and adherence now also feeds your outcome-linked price. Plenty of listed DiGAs generate little revenue because the commercial and clinical-engagement work never followed the regulatory win.

A DiGA listing is permission to be paid. Prescriptions are the business you still have to build.

We set out this exact gap, in DiGA terms, in the companion piece DiGA: getting an app prescribed, not just listed, and it sits inside the wider picture of medtech market access in Germany.

How we help

Two ways onto the DiGA fast-track

Start with a fixed, written read on your route and evidence, then plan execution — the listing choice, the study and the outcome-pricing model that now shapes revenue.

Step 1 · fixed deliverable

DiGA Access Roadmap

A one-off written roadmap for your app — eligibility, route, evidence and the pricing model, before you file.

  • Whether your app qualifies, and in which class
  • Provisional vs permanent, and the study design
  • The positive-care-effect claim to pursue
  • An outcome-linked pricing and revenue model
Order a roadmap
Step 2 · working session

Strategy consultation

A focused session to plan the fast-track, the data-security programme and the prescription-uptake push.

  • Sequencing CE, BSI and the BfArM filing
  • Designing the AbEM outcome capture
  • Physician awareness and prescribing workflow
  • A prioritised first-year plan
Book a consultation
Common questions

DiGA, answered

What is a DiGA?

A DiGA (Digitale Gesundheitsanwendung) is a low-risk medical-device app whose main function is digital and which supports the detection, treatment or management of a disease. Once listed in the BfArM directory it can be prescribed by doctors and reimbursed by German statutory health insurance.

How does the DiGA fast-track work?

You submit a complete application to BfArM, which must decide on inclusion in the DiGA directory within 90 days, assessing safety, quality, data protection, data security and either the proven positive care effect (permanent listing) or a study plan to prove it (provisional listing).

How long does DiGA approval take?

The BfArM review is 90 days once the application is complete. But the prerequisites (CE mark, BSI data-security certificate, GDPR) and, for provisional listings, the up-to-12-month trial period to prove the care effect, make the realistic end-to-end timeline considerably longer.

What is the difference between provisional and permanent DiGA listing?

Permanent listing requires a proven positive care effect at entry. Provisional listing lets you enter the directory — and be reimbursed — with a plausible effect and a study plan, then prove it during a trial period of up to about 12 months. Failure to prove it in time removes the app from the directory.

How is a DiGA priced and reimbursed?

You set the price for roughly the first year, then negotiate a reimbursement amount with the GKV-Spitzenverband, with arbitration if needed; negotiated prices are typically well below launch prices. Since 1 January 2026, at least 20% of the reimbursement must be tied to outcomes measured in real-world use (AbEM).

What data-security certification does a DiGA need?

GDPR compliance, an ISO 27001 information-security management system at company level, and the BSI TR-03161 data-security certificate per DiGA, which is mandatory — without it the app cannot be listed.

Does a DiGA listing mean doctors will prescribe it?

No. A listing makes the app reimbursable, not prescribed. Uptake depends on physician awareness, an easy prescribing workflow, patient activation and adherence — which, under the 2026 outcome rule, also affects your price.

AB
By Alexander Baranov
Commercial & Partnerships Lead · digital health access