1. Introduction
Digital health technologies (DHTs) are transforming many aspects of healthcare delivery (Mathias et al., Reference Mathias, McCulloch, Chalkidou and Gilbert2024). They are used at all stages of care, from prevention and patient monitoring to diagnosis and treatment, and have been associated with improvements in access and patient outcomes (Awad et al., Reference Awad, Trenfield, Pollard, Ong, Elbadawi, McCoubrey, Goyanes, Gaisford and Basit2021; Firth et al., Reference Firth, Torous, Nicholas, Carney, Rosenbaum and Sarris2017; Gray et al., Reference Gray, Indraratna, Lovell and Ooi2022; Zhong et al., Reference Zhong, Qiang, Wang and Sun2024). They can also generate and use real-world data and real-world evidence, although these possibilities have so far been only partly realised (Srivastava et al., Reference Srivastava, Henschke, Virtanen, Lotman, Friebel, Ardito and Petracca2023). Although the expectations about benefits are high, scholars have raised critical questions (Lievevrouw et al., Reference Lievevrouw, Marelli and Van Hoyweghen2024). The growing reliance on digital tools, along with the increasing volume and interconnectedness of sensitive data, has introduced considerable risks (Jeindl and Wild, Reference Jeindl and Wild2020). Two central concerns have emerged: safeguarding personal health information and preventing unauthorised access to systems and data (Coventry and Branley, Reference Coventry and Branley2018; Giansanti, Reference Giansanti2021; Kotz et al., Reference Kotz, Gunter, Kumar and Weiner2016; Sardi et al., Reference Sardi, Rizzi, Sorano and Guerrieri2020). Any device connected to a network or information system is inherently vulnerable to cyberattacks (Thomasian and Adashi, Reference Thomasian and Adashi2021). In healthcare, the risks are especially acute, as medical data are typically classified as highly sensitive under legal frameworks such as the European Union (EU) General Data Protection Regulation (GDPR, EU 2016/679).
The healthcare sector has experienced a growing number of cyber incidents in recent years (Kelly et al., Reference Kelly, Quinn, Belton, Lawlor, Killeen and Burrell2023), raising serious concerns about patient safety (O’Brien et al., Reference O’Brien, Ghafur and Durkin2021). Malware attacks, ransomware intrusions, and data breaches can disrupt healthcare operations, compromise patient data, and erode trust between providers and patients. In addition to the direct health consequences, such incidents can result in financial losses for healthcare organisations, jeopardise regional healthcare security, and expose institutions and professionals to legal and reputational risks (Arafa et al., Reference Arafa, Sheerah and Alsalamah2023).
The literature on information security distinguishes between two core domains relevant to this study. ‘Data protection’ refers to the safeguarding of individuals’ legally protected privacy rights in the processing of data. It is governed, in the EU, by instruments such as the GDPR, which contains opening clauses permitting complementary national provisions, and, in Switzerland, by the Federal Act on Data Protection (FADP). ‘Cybersecurity’ refers to the protection of network and information systems against cyber threats (Art. 2 EU Cybersecurity Act (CSA, (EU) 2019/881)).
Data protection and cybersecurity are regulated through a combination of sector-specific and horizontal legislation. Sector-specific rules include, in particular, the EU Medical Device Regulation (MDR, (EU) 2017/745). Horizontal legislation includes the second Network and Information Systems Directive (NIS2, (EU) 2022/2555), the CSA, which mandates the European Union Agency for Cybersecurity (ENISA) to support EU-wide cybersecurity policy, the EU Cyber Resilience Act (CRA, (EU) 2024/2847) (Tasheva and Kunkel, Reference Tasheva and Kunkel2022), the GDPR and its national implementations, and the Artificial Intelligence Act (AI Act, (EU) 2024/1689). Together, these legislative instruments create overlapping compliance obligations for DHT manufacturers and interdependencies between regulatory domains that affect both market access and reimbursement decision-making.
These legislative instruments impose cybersecurity and data protection requirements that apply to a broad range of sectors, including healthcare. Additional horizontal regulations, such as the Artificial Intelligence Act (AI Act, (EU) 2024/1689), introduce further compliance obligations for AI technologies, regardless of whether AI is used within a DHT or the AI technology itself constitutes a DHT. These multiple legislative layers increase complexity by creating interdependencies between different regulatory domains that affect both market access and reimbursement decision-making processes.
The term ‘DHT’ is widely used in the literature, but its exact meaning varies by national context (Jeindl and Wild, Reference Jeindl and Wild2024; Kohler and Rau, Reference Kohler and Rau2023; von Huben et al., Reference von Huben, Howell, Howard, Carrello and Norris2021). In Germany, the concept has been strongly influenced by § 33a of Social Code Book V (SGB V), which defines ‘Digitale Gesundheitsanwendungen’ (DiGAs) as a subset of software-based medical devices that fall within risk classes I and IIa/IIb of the EU Medical Device Regulation (MDR, (EU) 2017/745) and are eligible for reimbursement under the Fast-Track procedure (Kassner, Reference Kassner2023; Bundesinstitut für Arzneimittel und Medizinprodukte, n.d.). Therefore, DiGAs also only represent one specific form of DHTs in Germany. In contrast, the Swiss Federal Office of Public Health (FOPH) (Eidgenössisches Departement des Innern EDI, 2024) defines DHTs more inclusively as ‘products that serve health promotion, patient support, or medical purposes and utilise digital technologies’. We understand digital technologies as technologies that process, store, or transmit information in digital form – including, but not limited to, software applications, mobile apps, web-based platforms, AI-enabled tools, and connected devices. In the present study, we focus on patient-oriented DHTs eligible for reimbursement under statutory health insurance (Figure 1).
Conceptual framework for understanding digital health technologies. Notes: DHT = digital health technology, MDSW = medical device software according to the guidance on qualification and classification of software in regulation (EU) 2017/745; the difference in the length of the boxes under “Coverage” is intentional. It illustrates that non-reimbursable DHTs may include technologies with both a health-promoting and a medical purpose, while reimbursable DHTs are restricted to medical purposes only – but even within this category, not all are eligible for reimbursement. *We understand digital technologies as any technology that processes, stores, or transmits information in binary (digital) form – including, but not limited to, software applications, mobile apps, web-based platforms, AI-enabled tools, and connected devices.
Eligibility for reimbursement plays a key role in determining whether a DHT can move from clinical research into routine medical practice – one of the central challenges in translational medicine (Rogowski et al., Reference Rogowski, Hartz and John2008). Indeed, reimbursement decision-making and pricing considerations are often referred to as the ‘fourth hurdle’ (Paul and Trueman, Reference Paul and Trueman2001), reflecting the perception that they create an additional barrier to market entry after a product’s quality, efficacy, and safety have been demonstrated (Hutton et al., Reference Hutton, McGrath, Frybourg, Tremblay, Bramley-Harker and Henshall2006; Rogowski, Reference Rogowski2013; Taylor et al., Reference Taylor, Drummond, Salkeld and Sullivan2004). In short, reimbursement decision-making can be understood as ‘the determination of the level of funding provided by third-party payers which may involve different decision-making bodies’ (Rogowski et al., Reference Rogowski, Hartz and John2008). Originally, this concept centred on demonstrating cost-effectiveness as a prerequisite for patient access (Paul and Trueman, Reference Paul and Trueman2001; Rogowski et al., Reference Rogowski, Hartz and John2008). Nowadays, aspects of information security, such as data protection and cybersecurity, are increasingly being considered at this stage (Agoria and beMedTech, n.d.; Bundesinstitut für Arzneimittel und Medizinprodukte 2023, 2025; Eidgenössisches Departement des Innern EDI, 2024). However, the specific procedures, criteria, and institutional responsibilities through which these two domains are evaluated during reimbursement decision-making remain underexplored. This is an important research gap, as unclear or duplicative assessments of data protection and cybersecurity matters can create inefficiencies, increase uncertainty for manufacturers, and delay patient access to DHTs. Therefore, this study uses the concept of the ‘fourth hurdle’ as an analytical lens.
The present study compares how data protection and cybersecurity are evaluated during reimbursement decision-making for DHTs in Germany and Switzerland. The comparison follows a most different systems design (MDSD): despite their geographic proximity and similar level of economic development, the two countries differ markedly in how responsibility for these issues is situated within reimbursement processes. Germany established a dedicated Fast-Track pathway with explicit requirements in this area, representing a pioneering approach, whereas Switzerland continues to rely primarily on traditional reimbursement channels, reflecting a more conservative approach. Drawing on the concept of the ‘fourth hurdle’, we examine whether the growing inclusion of data protection and cybersecurity at the reimbursement stage extends reimbursement decision-making beyond its original focus on cost-effectiveness and patient access. We then consider the implications for regulatory duplication, uncertainty for manufacturers, innovation, predictability, and timely patient access, and for how institutional choices affect access to innovation. Based on this analysis, we propose a conceptual framework that shows how the MDR, national reimbursement systems, and cross-cutting legislative requirements interact and what this means for innovation and patient access.
The following subsections Outline the regulatory and reimbursement decision-making processes for DHTs in Germany and Switzerland. They distinguish between market access (ie. placing DHTs on the market via EU or EU-aligned regulatory procedures) and subsequent reimbursement decisions at the national level. Both processes can be situated within the broader debate on the so-called ‘fourth hurdle’.
1.1. Placing DHTs on the market
Unlike pharmaceuticals, medical devices in Europe are subject to a conformity assessment process rather than formal regulatory approval. In the EU, this process is governed by the MDR, which seeks to balance innovation with patient safety (Shatrov and Blankart, Reference Shatrov and Blankart2022). Switzerland has adopted similar provisions through its national Therapeutic Products Act (TPA) and the corresponding Medical Devices Ordinance (MedDO). Both are aligned with the MDR, but Switzerland remains independent and is considered a third country by the EU.
The classification of a product as a medical device depends on its intended purpose, as defined by the manufacturer or developer (Meier and Cortizo, Reference Meier, Cortizo, Eichenberger, Jaisli and Richli2022). If classified as such, DHTs must comply with the essential technical requirements set out in the MDR – or, in Switzerland, the MedDO (Blankart et al., Reference Blankart, Dams, Penton, Zán, Zemplényi, Shatrov, Iskandar and Federici2021). Annex I, Section 17.2 of the MDR explicitly requires that software developers adhere to the state of the art, including the implementation of appropriate information security measures. The MDR also contains provisions related to data protection, and the European Commission’s Medical Device Coordination Group (MDCG) (2020) has issued additional guidance (MDCG 2019-16) on IT and cybersecurity requirements under the MDR and the In Vitro Diagnostic Regulation (IVDR, EU 2017/746).
1.2. Fourth hurdle processes
After placing a DHT on the market, manufacturers typically seek reimbursement through national healthcare systems, since new products can only be translated into medical practice on a large scale if they are reimbursed by third-party payers (Rogowski et al., Reference Rogowski, Hartz and John2008). The notion of a ‘fourth hurdle’ emerged in the 1990s to describe the inclusion of cost-effectiveness evidence in reimbursement (Hutton et al., Reference Hutton, McGrath, Frybourg, Tremblay, Bramley-Harker and Henshall2006; Taylor et al., Reference Taylor, Drummond, Salkeld and Sullivan2004).
In contrast to the market access process, reimbursement decision-making takes place at the national level. Today, reimbursement decisions still cover cost-effectiveness but also include domains such as legal aspects (Kristensen et al., Reference Kristensen, Lampe, Wild, Cerbo, Goettsch and Becla2017; Lampe et al., Reference Lampe, Mäkelä, Garrido, Anttila, Autti-Rämö, Hicks, Hofmann, Koivisto, Kunz, Kärki, Malmivaara, Meiesaar, Reiman-Möttönen, Norderhaug, Pasternack, Ruano-Ravina, Räsänen, Saalasti-Koskinen, Saarni, Walin and Kristensen2009). With regard to DHTs, several countries consider aspects of information security, such as data protection and cybersecurity within this ‘fourth hurdle’ (see, eg. Agoria and beMedTech, n.d.; Bundesinstitut für Arzneimittel und Medizinprodukte 2023, 2025; Eidgenössisches Departement des Innern EDI, 2024).
1.3. Country-specific reimbursement processes
Germany, along with countries such as Italy, the Netherlands, Poland, Sweden, and the United Kingdom, recognises DHTs as a distinct classification. In contrast, Switzerland, like Belgium, France, and Israel, classifies DHTs under the traditional paradigm of medical devices (van Kessel et al., Reference van Kessel, Srivastava, Kyriopoulos, Monti, Novillo-Ortiz, Milman, Zhang-Czabanowski, Nasi, Stern, Wharton and Mossialos2023), though some of these countries have introduced digital health-specific reimbursement pathways within that framework, such as mHealthBelgium and France’s PECAN. In Switzerland, recent reforms likewise place certain digital health applications within an existing reimbursement list rather than creating a dedicated pathway comparable to the DiGA model.
1.3.1. Germany: a distinct reimbursement system
In Germany, the Digital Healthcare Act (Digitale-Versorgung-Gesetz, DVG) and the Digital Health Applications Regulation (Digitale-Gesundheitsanwendungen-Verordnung, DiGAV) were introduced in 2019. Together, they established the Fast-Track reimbursement procedure, which is administered by the Federal Institute for Drugs and Medical Devices (BfArM). This procedure allows certain DHTs, officially designated as DiGAs and sometimes referred to informally as ‘prescription apps’, to be included in the DiGA directory, which lists DHTs that are eligible for reimbursement under the statutory health insurance system (Sauermann et al., Reference Sauermann, Herzberg, Burkert and Habetha2022). Other DHTs may be reimbursed through established routes outside the DiGA Fast-Track procedure, including service reimbursement mechanisms such as telemonitoring via uniform assessment standard (EBM) inclusion or the list of aids (Hilfsmittelverzeichnis).
To qualify for inclusion in the DiGA directory, DHTs must (a) demonstrate safety and functionality through the conformity assessment required as part of the market access process, (b) fall within MDR risk classes I or IIa/IIb, and (c) meet additional criteria related to data protection, data security, and cybersecurity under the Fast-Track reimbursement procedure. Manufacturers must complete Annex 1 of the DiGAV and describe how they meet the data protection requirements, including compliance with the GDPR and applicable national data protection legislation. Since 1 January 2025, compliance with data security requirements must also be demonstrated by submitting a certificate based on BSI Technical Guideline TR-03161. A comparable certification pathway for data protection under Article 42 GDPR is provided for in § 139e (11) SGB V and § 78a (8) SGB XI but had not yet been implemented at the time of writing (Bundesinstitut für Arzneimittel und Medizinprodukte 2025).
1.3.2. Switzerland: a traditional reimbursement paradigm
In Switzerland, reimbursement for DHTs follows existing pathways for medical devices and other healthcare products and services. The Federal Council has argued that a separate reimbursement pathway for DHTs is unnecessary (Bundesversammlung, 2022). This position remains contested because certain DHTs may not be adequately covered by the current arrangements (Allianz Digitale Transformation im Gesundheitswesen, 2024). More recently, the Swiss Federal Department of Home Affairs (EDI) introduced a new Chapter 40 in the Mittel- und Gegenständeliste (MiGeL), the Swiss list of reimbursable medical aids and devices, for digital health applications with a medical purpose, effective 1 July 2026. However, this still does not amount to a dedicated reimbursement pathway comparable to the DiGA model in Germany.
Reimbursement under Switzerland’s statutory health insurance system is primarily governed by Article 32 of the Federal Health Insurance Act (KVG), which requires that all reimbursable interventions meet the so-called WZW criteria: effectiveness (Wirksamkeit), appropriateness (Zweckmässigkeit), and cost-effectiveness (Wirtschaftlichkeit). An intervention is considered appropriate if it complies with relevant legal requirements, as well as ethical and social considerations. However, data protection and cybersecurity are not explicitly evaluated as part of the WZW criteria and are instead treated as having been addressed during the market access process under the MedDO (Blankart et al., Reference Blankart, Eule and Wyss2024).
2. Methods
This study employed a qualitative, exploratory design to compare how data protection and cybersecurity are evaluated during reimbursement decision-making for DHTs in Germany and Switzerland. We combined document analysis and expert interviews in a two-stage approach to allow data triangulation and contextualisation of findings. The section is structured as follows: first, we present the research design and explain the rationale for our data sources. Second, we detail data collection, including sampling, recruitment, and participant characteristics. Third, we outline our analytical approach, drawing on grounded theory principles and the Gioia methodology to ensure rigour and transparency. Overall, the study adhered to the Consolidated Criteria for Reporting Qualitative Research (COREQ) (Tong et al., Reference Tong, Sainsbury and Craig2007). The complete COREQ checklist is provided in Supplementary Material 2 .
2.1 Research design
Our research design was guided by the aim of capturing both the formal regulatory setting and the lived practices of actors involved in evaluating data protection and cybersecurity in the context of reimbursement processes for DHTs. The case selection followed a most different systems design, using Germany and Switzerland as contrasting cases. Germany established a formalised Fast-Track procedure with explicit requirements for data protection and cybersecurity, whereas Switzerland integrates DHTs into traditional reimbursement mechanisms without creating a specific category. Both countries operate highly developed healthcare systems and share similarities in terms of economic resources and technological adoption, but they diverge in their approach to DHT reimbursement.
To achieve this aim, we combined two complementary data sources: semi-structured expert interviews to explore how data protection and cybersecurity considerations are assessed in practice and the systematic analysis of policy and regulatory documents to map the relevant legal and institutional structures in Germany and Switzerland.
Semi-structured expert interviews (Meuser and Nagel, Reference Meuser, Nagel, Garz and Kraimer1991) were chosen because they are particularly well-suited for the exploration of perceptions and opinions, especially within complex issues (Barriball and While, Reference Barriball and While1994; Kallio et al., Reference Kallio, Pietilä, Johnson and Kangasniemi2016). The interview guide was developed iteratively. Initial questions were derived from the literature and relevant policy documents. A pilot interview was conducted to test the guide, which led to further adjustments to improve clarity and thematic coverage. The final version allowed structured comparability across interviews while retaining the flexibility to probe emerging issues in greater depth (Ryan et al., Reference Ryan, Coughlan and Cronin2009). The questions were separated into main themes and follow-up questions (Kallio et al., Reference Kallio, Pietilä, Johnson and Kangasniemi2016). The complete interview guide is provided in Supplementary Material 1 . Both authors have academic backgrounds in health policy and governance but no institutional affiliation with the organisations under study and no interests in specific regulatory outcomes. Nonetheless, we understand researcher subjectivity, in line with reflexive thematic analysis, not as a threat but as a resource in knowledge production (Braun and Clarke, Reference Braun and Clarke2006, Reference Braun and Clarke2019). The generation of themes was therefore not conceived as a passive process of discovery but as an active interpretive process situated at the intersection of theoretical assumptions, analytic skills, and the empirical material, where ‘themes are creative and interpretive stories about the data’ (Braun and Clarke, Reference Braun and Clarke2019).
2.2 Data collection
Participants were selected through purposeful sampling to ensure the inclusion of individuals with appropriate expertise and experience (Campbell et al., Reference Campbell, Greenwood, Prior, Shearer, Walkem, Young, Bywaters and Walker2020). We sampled distinct stakeholder groups with expertise in key areas of DHT reimbursement, including regulation, market access, reimbursement decision-making, data protection and cybersecurity, and clinical provision. For administrative and regulatory bodies, we contacted the relevant offices directly. For associations representing professional, patient, payer, and manufacturer interests, we contacted the corresponding national organisations and were referred to appropriate interview partners. Additional interviewees were recruited from other organisations relevant to the field, including a DiGA developer, which was chosen at random from the eligible options. This diversity allowed us to capture a range of perspectives. Most participants had more than ten years of professional experience in their respective fields.
In total, 18 experts from 14 different institutions were interviewed. All but one interview took place online, and one was held in person. Two organisations declined to participate: one could not nominate a suitable interviewee, and the other declined for political reasons. Interviews were conducted in German (except for one in English), video-recorded with consent, and transcribed verbatim. Interview length ranged from 34 to 60 minutes, with an average duration of 47 minutes. Quotations were translated from German into English by the authors and were cross-checked with native speakers. To preserve anonymity and encourage openness while ensuring transparency, we report aggregated participant information (see Table 1 and Supplementary Material 3 ). The adequacy of the sample size was assessed using the concept of ‘information power’ (Malterud et al., Reference Malterud, Siersma and Guassora2016). Given the specificity of the participants (senior experts), the theoretical orientation of the study, and the narrow focus on two national contexts, the sample was deemed sufficient to support meaningful analysis.
Overview of interview partners and documents included in the qualitative analysis
Table 1. Long description
A table with 18 rows and 2 columns. The first column lists interview partners, and the second column lists policy documents. The interview partners include 2 experts from the Federal Office of Public Health (FOPH), 1 expert from Swissmedic, 2 experts from the National Cyber Security Center (BACS), 1 expert from the Federal Data Protection and Information Commissioner (EDÖB), 1 expert from the cantonal data protection office, 1 expert from a manufacturers’ association, 1 expert from a university hospital, 1 expert from a private hospital group, 1 expert from an insurance association, 1 expert from a patient organisation, 1 expert from a consultancy in the medical technology industry, 2 experts from a nursing association, 2 experts from a German DiGA developer, and 1 expert from a notified body. The policy documents include 4 entries: a fact sheet on reimbursement of digital health applications, mobile health recommendations, practical guidance for app developers, and a fast-track procedure for digital health applications.
In addition to the interviews, we analysed four key policy documents: (1) Fact Sheet: Reimbursement of Digital Health Applications under Mandatory Health Insurance (OKP), (2) Mobile Health (mHealth) Recommendations I, (3) Guideline for App Developers, Manufacturers, and Distributors: Practical Guidance, and (4) The Fast-Track Procedure for Digital Health Applications (DiGA) under § 139e Social Code Book V (Version 3.4, October 2023 and Version 3.6, December 2025). These documents complemented the interview data by situating expert perspectives within the broader governance framework.
2.3 Analysis
Data analysis followed an inductive approach grounded in qualitative research traditions. We combined reflexive thematic analysis (Braun and Clarke, Reference Braun and Clarke2006) with the Gioia methodology (Gioia et al., Reference Gioia, Corley and Hamilton2013), which is widely used to enhance transparency and rigour in theory-building research (Magnani and Gioia, Reference Magnani and Gioia2023). The coding process began with close engagement with the interview transcripts. In a first round of open coding (Corbin and Strauss, Reference Corbin and Strauss1990), we generated 110 distinct first-order concepts by adhering closely to the terminology used by participants (Gioia et al., Reference Gioia, Corley and Hamilton2013). These concepts were then iteratively compared, grouped, and abstracted into higher-order themes, aligning with axial coding principles (Corbin and Strauss, Reference Corbin and Strauss1990). Generating second-order themes and aggregated dimensions involved a process of sorting, reducing, and aggregating first-order codes (Magnani and Gioia, Reference Magnani and Gioia2023).
This process was highly iterative: analysis began after the first interviews were completed and was continuously refined as new data became available. We also used policy documents and relevant literature on the German and Swiss healthcare systems to triangulate findings and contextualise participant accounts. The final data structure (Figure 2) illustrates the relationship between first-order concepts, second-order themes, and aggregated dimensions. Although the analysis focused on recurring patterns among participants, we also considered divergent or isolated perspectives when they provided valuable additional insights. Nevertheless, not all first-order concepts resulted in second-order themes and subsequently in aggregated dimensions. Data management and coding were supported by MAXQDA software, which facilitated systematic organisation and retrieval of material.
Overview of data coding and thematic structure. Notes: DHT = digital health technology; EN = European Standard; EU = European Union; ISO = International Organisation for Standardisation.
Long description
A diagram illustrating the thematic structure of digital health technologies (DHTs) and their regulatory challenges. The diagram is divided into three main sections: Selection of First-Order Concepts, Second-Order Themes, and Aggregated Dimensions. The Selection of First-Order Concepts includes various issues such as reimbursement versus conformity assessment, disclaiming responsibility, role of other actors, intentional exclusion, regulatory redundancies, varying definitions and understandings of DHTs, need for certainty for manufacturers, unclear or problematic rules and laws, lack of capacity within authorities, certification bottlenecks, shortage of specialized expertise within authorities, international standards, country-specific regulatory requirements, and upcoming regulatory developments. These concepts are linked to Second-Order Themes, which include unclear distribution of responsibilities and roles, regulatory redundancies, varying definitions and understandings of DHTs, predictability and legal certainty, lack of capacity within authorities, certification bottlenecks, shortage of specialized expertise within authorities, international standards, country-specific regulatory requirements, and upcoming regulatory developments. These themes are further aggregated into three main dimensions: Governance mechanisms, Skills and resource development, and Consideration of international standards and emerging legislation.
3. Results
This section presents our findings along three aggregated dimensions: governance mechanisms, skills and resource development, and consideration of international standards and emerging legislation.
3.1 Governance mechanisms
In Germany, governance responsibilities for data protection and cybersecurity at the reimbursement stage are institutionalised within the Fast-Track procedure. In Switzerland, by contrast, reimbursement decisions under the KVG procedure do not include a standardised evaluation of data protection and cybersecurity, as these aspects are treated as having been addressed at the market access stage. These differences reflect broader variation in how DHTs are defined, categorised, and assessed for reimbursement eligibility. According to our document analysis and interviewees, Germany has established a clearer and more specific governance structure through the Fast-Track procedure. In contrast, participants described Switzerland’s approach as broader and having less formalised oversight mechanisms. Particularly in Switzerland, interviewees spoke about ongoing uncertainty regarding the allocation of responsibilities for verifying compliance with these requirements. As one expert asked, ‘Who holds the necessary resources and competencies, who is effectively able to carry out the tasks, and who has the formal mandate?’
As noted above, services in Switzerland are eligible for reimbursement under mandatory health insurance if they meet the criteria of effectiveness, appropriateness, and cost-effectiveness, with cybersecurity considerations falling under the FOPH’s operationalisation of appropriateness. However, our interviews confirmed that there is no standardised procedure for this assessment. As one expert explained, ‘Cybersecurity and data protection are considered under the appropriateness criterion but are currently only superficially assessed – eg. certifications and data storage locations. There is no standard process for each application yet, but this is precisely what is needed’. Publicly available documents and application forms issued by the FOPH confirm that only superficial aspects of data protection and cybersecurity are currently addressed, such as universally relevant data protection aspects (Bundesamt für Gesundheit BAG, 2024, 2025). Moreover, interviewees expressed uncertainty about the scope of the FOPH’s authority in this domain: ‘What is the FOPH required and allowed to evaluate? What has already been addressed by Swissmedic?’; ‘Data protection and cybersecurity are not criteria under the KVG. The law focuses on efficiency, costs, and efficacy with regard to the illness’.
This absence of explicit evaluation procedures in Switzerland contrasts with the formalised requirements established in Germany’s Fast-Track reimbursement procedure, where DiGA manufacturers must demonstrate compliance with data protection and cybersecurity requirements as part of their reimbursement application. However, some experts questioned whether national reimbursement bodies should be responsible for evaluating data protection and cybersecurity at all. As one participant argued, ‘Why would the FOPH even evaluate these aspects? Their role should be to establish the rules or explain how they need to be implemented’. Another expert emphasised that additional evaluations may be redundant given the extensive requirements already addressed during market access conformity assessment under the MDR: ‘Basically, the FOPH could end up reviewing the same aspects already assessed by Swissmedic – this simply leads to duplication of work’. Nevertheless, some participants noted the value of clear rules and processes at the reimbursement stage, even if they result in redundancies. As one interviewee commented, ‘Rules are necessary. Better to have them than not. Once a clear path is established, manufacturers know what to expect’.
3.2 Skills and resource development
Interviewees also raised concerns about the feasibility of evaluating data protection and cybersecurity as part of reimbursement decision-making, particularly in Switzerland. Several participants noted that direct oversight by authorities such as the FOPH requires considerable technical expertise and resources that are currently lacking. As one expert explained, ‘[An evaluation by the FOPH] is beyond what is possible in Switzerland – eg. [in terms of having the necessary] human resources and expertise’.
Participants also pointed to systemic capacity limitations at the national level. For example, the National Cyber Security Center (BACS) in Switzerland was described as understaffed compared to its counterparts abroad: ‘The BSI [German Federal Office for Information Security] has 1,000 people. They have many skilled staff, and their publications are top-notch. This is absolutely lacking at the federal level in Switzerland’. These observations are consistent with existing literature documenting a shortage of qualified specialists in data protection, cybersecurity, and information security in Switzerland (Dalal et al., Reference Dalal, Howard, Bennett, Posey, Zaccaro and Brummel2022; Huber, Reference Huber, Vasella and Blechta2024; Mishra et al., Reference Mishra, Alzoubi, Anwar and Gill2022).
Concerns about institutional capacity were also raised in the German context. Several interviewees questioned whether the BfArM possessed the necessary expertise to develop and apply cybersecurity standards within the DiGA Fast-Track reimbursement procedure. As one expert remarked, ‘The BfArM cannot set standards; they’ve never done so. They’re not qualified for this. How could anyone think they could create national standards?’ Another noted, ‘The BfArM is coming up with something on its own, but it has many weaknesses. To be honest, it’s a 1 minus [ie. a poor mark]. It’s unworkable, and no one wants to certify it. The accreditation authority is essentially saying, ‘What is this supposed to be?’’ A third participant concluded more broadly, ‘The BfArM’s approach is questionable’.
Within this topic area, participants reflected on centralised and decentralised approaches to evaluation in reimbursement decision-making processes (Essén et al., Reference Essén, Stern, Haase, Car, Greaves, Paparova, Vandeput, Wehrens and Bates2022). Several interviewees suggested that decentralised models – ie. relying on notified bodies and existing MDR conformity assessment procedures – could reduce the need for additional personnel and expertise in reimbursement authorities. As one expert explained, ‘For DHTs above risk class I, a four-eyes principle applies […], and together with the MDR, there are already more than enough requirements in place [to ensure oversight]’.
However, participants also cautioned that decentralisation might introduce new problems. In particular, relying on national standards while delegating evaluation responsibilities to notified bodies or other certifying agencies could lead to bottlenecks and higher costs given the limited number of certifying entities with appropriate expertise. As one expert explained, ‘There is not one [notified body] willing to certify it. So how is it possible to come up with the idea of creating national standards in such a situation? […] The fact that no certifier can be found, and that the three existing ones charge exorbitant fees – because they can now act like robber barons – is a serious issue’.
3.3 Consideration of international standards and emerging legislation
Several participants questioned the fundamental utility of additional oversight by national authorities in the area of data protection and cybersecurity as part of reimbursement decision-making. One expert, eg. doubted whether data protection considerations should even be part of Switzerland’s WZW criteria for reimbursement eligibility: ‘WZW should primarily focus on efficiency, cost-effectiveness, and medical accuracy. Data protection should always be considered but is not inherently a cost or medical issue’. Critics of the German approach raised concerns about the creation of national standards for cybersecurity within the Fast-Track process. Instead, they argued that internationally recognised certifications such as ISO 27001 (Information Security Management Systems) or ISO 27701 (Privacy Information Management) should serve as the basis for evaluation: ‘Manufacturers should be required to obtain certification according to international standards; this would bring a certain seriousness to the industry’. At the same time, some degree of national oversight was seen as important for building and maintaining trust in DHTs: ‘It is not wrong to have some oversight because if DiGAs keep getting hacked, it would be bad for the sector’. However, the implementation of the current oversight was widely criticised: ‘The idea of oversight is right, but the execution is poor’.
Several participants argued that international standards serve as a more efficient and widely accepted basis for addressing data protection and cybersecurity considerations, reducing the risk of duplication at the reimbursement decision-making stage. As one expert explained, ‘Always base [reimbursement decision-making criteria] on international standards, EU and ISO. They are seen by a lot of people, and are scrutinised and updated. Country-specific solutions don’t get the same level of attention’. Although this view dominated, a minority of participants questioned the practical security value of such certifications. They argued that ISO standards often reflect static compliance checklists rather than dynamic assessments of emerging threats.
Relying on international standards was seen by many interviewees as a way to avoid redundant evaluations, ensure a consistent and credible assessment framework for manufacturers, and support the cross-country adoption of DHTs – an issue of particular relevance for smaller markets such as Switzerland. In addition, participants noted that the European regulatory landscape continues to evolve, with new horizontal cybersecurity legislation (eg. NIS2 and the CRA) adding further complexity for regulators and manufacturers alike (Tasheva and Kunkel, Reference Tasheva and Kunkel2022).
4. Discussion and policy implications
National reimbursement systems do not operate in isolation but are embedded in a broader network of interactions involving international regulatory frameworks and horizontal legislative requirements related to data protection and cybersecurity. These interdependencies influence how countries balance security, privacy, and innovation in market access and reimbursement processes for DHTs. The degree of overlap or duplication between regulatory requirements and reimbursement-specific evaluations affects not only the complexity of these processes but also the quantity, diversity, and accessibility of digital health innovations.
The interactions between regulatory frameworks and national reimbursement systems are important junctures in the translational medicine process. Whereas the first three hurdles of quality, safety, and efficacy are well established in European regulatory frameworks, our findings suggest that the introduction of additional data protection and cybersecurity evaluations at the reimbursement stage – within the ‘fourth hurdle’ – risks stretching this stage beyond its intended scope. In Germany, the Fast-Track procedure, for example, imposes additional and, in part, redundant country-specific requirements for information security, which raises concerns about inefficiency. However, Germany’s decision to introduce these requirements was made in 2019, at a time when the MDR had not yet been fully implemented and EU cybersecurity legislation, including NIS2 and the CRA, was still emerging. In that context, the additional national requirements can be understood as an attempt to build trust in a new reimbursement category and to fill perceived regulatory gaps. As the relevant EU rules have developed further, the case for maintaining such country-specific requirements may need to be reconsidered. Using Belgium as an example, Lievevrouw et al. (Reference Lievevrouw, Marelli and Van Hoyweghen2024) illustrate how reimbursement arrangements can ‘lock in’ frictions around trust, definitions of medical devices, empowered patients, and valuable data, even when they are consistent with EU law. In this way, they may impede rather than accelerate DHT uptake.
Drawing on Drezner’s (Reference Drezner2008) concept of state power – measured by internal market size or the cost of policy adjustment – we argue that larger and more influential countries, such as Germany, have greater capacity to design or modify reimbursement systems by introducing country-specific criteria and additional requirements beyond those set out in international regulatory (ie. market access) frameworks. In our study, some participants questioned the necessity and effectiveness of these additional requirements in Germany’s Fast-Track procedure. In contrast, smaller countries like Switzerland, with more limited state power, may benefit from aligning their reimbursement decision-making with international standards to facilitate patient access to novel technologies (Gillner et al., Reference Gillner, Blankart, Bourgeois, Stern and Blankart2024).
Figure 3 visualises these dynamics. It illustrates how regulatory frameworks and national reimbursement systems interact with each other and various horizontal legislative requirements to influence the development and adoption of DHTs in terms of quantity, diversity, and accessibility, as indicated by the arrows. The dark grey areas in the figure show where cross-cutting issues, such as data protection and cybersecurity, create overlap between these domains. While cybersecurity and other security concerns are largely addressed in European regulatory frameworks, the implementation of data protection requirements and the applicable legal provisions vary by country (Chen and Zhao, Reference Chen and Zhao2012). Thus, cybersecurity tends to be substantively addressed at the market access stage, whereas data protection obligations, although relevant to both domains, are addressed more fully at the reimbursement stage, where compliance with data protection requirements is assessed directly. Other cross-cutting themes may be addressed either within the market access regulations (the first vertical stream in the figure) or national reimbursement systems (the second vertical stream), depending on the specific policy area.
Interplay of regulatory and legislative requirements in digital health innovations. Notes: AI = artificial intelligence (EU AI Act); CSA = EU Cybersecurity Act; DHT = digital health technology. Dark grey areas show where traditionally cross-cutting themes are located. Light grey areas indicate less extensive (but still existing) overlaps across domains. Striped areas represent domains where forthcoming regulation will determine the dominant authority.
The regulatory landscape for DHTs continues to evolve, and new legislative initiatives are affecting future requirements for data protection and cybersecurity in healthcare. One of the most important developments is the EU AI Act mentioned above, which introduces risk-based classification and compliance requirements for AI applications, including those in healthcare. AI-enabled DHTs classified as medical devices requiring third-party conformity assessment under the MDR are also subject to the high-risk requirements under Article 6 of the AI Act. The level of regulatory oversight therefore differs between DHT types according to risk classification (see also Aboy et al., Reference Aboy, Minssen and Vayena2024; Joint Artificial Intelligence Board and Medical Device Coordination Group, 2025; Luckner and Lauer, Reference Luckner and Lauer2025). In Switzerland, the absence of specific AI legislation leaves the corresponding questions of regulatory oversight unresolved.
Beyond the MDR and the AI Act, other horizontal legislative instruments are also relevant to the governance of information security in DHT reimbursement. The GDPR establishes binding requirements for the processing of personal health data and applies directly in Germany and throughout the EU. In Switzerland, comparable data protection obligations are governed by the FADP. Although compliance with the GDPR is formally assessed at the market access stage, our findings indicate that data protection considerations also reappear at the reimbursement stage, particularly in Germany’s Fast-Track procedure, where manufacturers must demonstrate compliance with the GDPR when completing Annex 1 of the DiGAV. Looking ahead, the European Health Data Space (EHDS) regulation entered into force in March 2025. Although it does not directly govern reimbursement decision-making, it will probably influence how data protection obligations are interpreted in national reimbursement contexts as its implementation progresses.
Our findings are consistent with existing research on the complexities of DHT regulation. Prior studies have identified divergent approaches to DHT reimbursement in different European countries (van Kessel et al., Reference van Kessel, Srivastava, Kyriopoulos, Monti, Novillo-Ortiz, Milman, Zhang-Czabanowski, Nasi, Stern, Wharton and Mossialos2023). For example, Tasheva and Kunkel (Reference Tasheva and Kunkel2022) examined the evolving EU cybersecurity policy landscape, illustrating how horizontal and sector-specific regulations are being developed in parallel. Although previous research has examined the challenges of including DHTs in health technology assessment (Haverinen et al., Reference Haverinen, Keränen, Falkenbach, Maijala, Kolehmainen and Reponen2019; Jääskelä et al., Reference Jääskelä, Haverinen, Kaksonen, Reponen, Halunen, Tokola and Röning2022; Jeindl and Wild, Reference Jeindl and Wild2020; Moshi et al., Reference Moshi, Tooher and Merlin2018; Vis et al., Reference Vis, Bührmann, Riper and Ossebaard2020), our study adds to this literature by examining how data protection and cybersecurity are handled in relation to reimbursement decision-making for DHTs in two contrasting national systems. In addition, our findings corroborate those of Rogowski et al. (Reference Rogowski, Hartz and John2008) on the ‘fourth hurdle’ in reimbursement decisions, providing further evidence that effective coordination between regulatory frameworks and reimbursement decision-making requirements plays an important role in the adoption of digital health innovations. Moreover, our findings contribute to the literature on the ‘fourth hurdle’ by demonstrating how its scope is expanding beyond cost-effectiveness to include information security. While such an expansion reflects legitimate societal concerns about privacy and trust, it risks stretching the ‘fourth hurdle’ beyond its original purpose. This supports the argument of Rogowski (Reference Rogowski2013) that ‘fourth hurdle’ processes can provide value if they direct healthcare resources to their most efficient use. However, changing reimbursement policies and duplicating assessments in areas such as data protection and cybersecurity may increase redundancies and administrative burdens, thereby undermining rather than enhancing efficiency.
Although our findings suggest that relying on existing international standards and EU frameworks is preferable to introducing additional national requirements, neither fully resolves all cybersecurity-related issues. Indeed, recent evidence indicates that, despite its explicit cybersecurity provisions in Annex I, the MDR still has gaps in scope, specificity, and responsiveness to emerging threats (Ostermann et al., Reference Ostermann, Mathias, Jahed, Parker, Hudson, Harding, Gilbert and Freyer2025). This raises the question of who should address these gaps. In practice, national decision-makers may need to decide whether additional national requirements are necessary and, if so, how they should be designed. Any such decision would need to take account of the trade-offs involved, particularly those between security, innovation, and administrative burden. In smaller markets such as Switzerland, additional national requirements might discourage market entry and limit patient access. In the meantime, existing national authorities, such as BfArM and FOPH, retain an important oversight role even where their formal remit is not fully defined and their technical capacity may be insufficient. One possible interim approach would be to rely on existing supranational structures such as ENISA and on recognised reference points, including international standards such as ISO 27001 and the cybersecurity requirements set out in MDR Annex I until further regulatory development takes place at the EU level.
Our findings also point to a structural gap in expertise at the national level. Effective oversight of information security in DHT reimbursement requires specialised expertise that is currently limited in authorities such as the FOPH and, to some extent, BfArM. Which specific competencies, resources, and institutional arrangements would be needed to establish effective oversight is not yet settled and would require further empirical study. Our findings nevertheless point to at least three broad areas of competence: (i) technical information security expertise to evaluate compliance with cybersecurity standards, (ii) legal expertise in data protection given the jurisdictional complexity arising from the interplay of the GDPR, national legislation, and sector-specific regulation, and (iii) regulatory expertise to assess conformity with the MDR in the EU or the MedDO in Switzerland, as well as relevant horizontal cybersecurity legislation in the respective jurisdiction. Whether these competencies are best concentrated within existing national authorities, delegated to specialised agencies, or coordinated at a supranational level (eg. through ENISA in the EU context or through Swissmedic and the FOPH in Switzerland) lies beyond the scope of this study.
Moreover, DHTs are often embedded in broader data infrastructures, including interoperability standards such as FHIR and HL7, that may introduce additional cybersecurity vulnerabilities, including unauthorised access (Waseem et al., Reference Waseem, Islam, Harrison, Epiphaniou, Matragkas, Arvanitis and Maple2025). This increases the difficulty for reimbursement authorities, which would need to consider not only the DHT itself but also the surrounding infrastructure in addition to the capacity and expertise constraints identified in this study.
Interviewees consistently emphasised that clear, predictable, and internationally aligned requirements are essential for manufacturers operating in multiple European jurisdictions. Stakeholders emphasised that relying on existing regulatory requirements and standards, particularly the MDR, GDPR and recognised ISO-based cybersecurity standards, would offer a pragmatic and trusted basis for evaluating DHTs and prevent the creation of fragmented national rules. At the same time, these requirements and standards also have weaknesses, including unclear scope, inconsistent levels of detail, and thematic gaps, as recently shown by Ostermann et al. (Reference Ostermann, Mathias, Jahed, Parker, Hudson, Harding, Gilbert and Freyer2025) for the MDR and Tronnier et al. (Reference Tronnier, Löbner, Lacombe, Rannenberg, Drevin, Leung and von Solms2025) for the AI Act. However, nationally defined cybersecurity catalogues or country-specific certification requirements were viewed critically because they may limit the pool of conformity-assessment bodies able to evaluate DHTs, as only bodies accredited under the relevant national standards are eligible to do so. This may reduce manufacturer choice and create bottlenecks, particularly in smaller markets.
Although our analysis was not designed to compare perspectives systematically by expert role, some differences in emphasis were apparent. Interviewees’ institutional positions and professional backgrounds appeared to influence which aspects of the topic they foregrounded. For example, regulatory and insurance-affiliated interviewees more often described information security as lying outside their remit, which suggests some uncertainty about responsibilities in this area. In contrast, interviewees involved in federal commissions, regulatory assessment, or scientific review placed greater emphasis on methodological standards and a clear allocation of regulatory responsibilities. Interviewees from the manufacturing side, including the DiGA developer and industry representatives, tended to express the importance of clear and predictable rules for planning and market entry. Data protection and cybersecurity experts likewise generally favoured reliance on international standards rather than additional national requirements. At the same time, these differences in emphasis emerged against a background of broad agreement on the main issues discussed. Overall, these observations should be interpreted cautiously, as the study was not designed to assess differences systematically across interviewee roles.
This study has several limitations. First, although our qualitative approach allowed for the collection of detailed perspectives, the findings are based solely on expert opinions from Switzerland and Germany, which limits their generalisability to other healthcare systems. Nevertheless, the conceptual framework we developed should be applicable to most European countries. Second, regulatory and reimbursement requirements for DHTs continue to evolve, meaning that our analysis represents only a snapshot in time. Future research should explore how emerging cybersecurity regulations (eg. NIS2, CRA) may affect reimbursement decision-making. Future research could also include a systematic gap analysis of competencies and resources within relevant national authorities. Finally, countries outside of Europe, such as the United States, follow very different regulatory approaches that warrant further comparative analysis.
5. Conclusion
For decision-makers, a central question is how the interplay between regulatory frameworks and national reimbursement systems affects data protection, cybersecurity, and, ultimately, the quantity, diversity, and accessibility of DHT innovations. Our findings suggest that reimbursement systems may need to give greater recognition to, and rely more on, existing international regulatory standards, such as those established under the MDR, GDPR, and relevant ISO norms, in order to reduce redundancies and improve predictability for manufacturers. They also suggest that fragmented responsibilities and the lack of clear coordination between market-access requirements and reimbursement decision-making criteria may create avoidable difficulties in this area. In smaller markets such as Switzerland, country-specific requirements beyond those already mandated through international rules may discourage market entry. Although our analysis focused on Germany and Switzerland, the findings point to governance trade-offs that may also be found elsewhere in Europe. Similar tensions between national reimbursement practices and cross-cutting requirements such as data protection and cybersecurity may also occur in other health systems, and the approach used in this study may be useful in analysing them.
Supplementary material
The supplementary material for this article can be found at https://doi.org/10.1017/S1744133126100735.
Data statement
The interview transcripts and related qualitative data underlying this study cannot be shared publicly due to confidentiality agreements and the sensitive nature of the material. The dataset contains information that could compromise the privacy of participants. Access to specific anonymised passages may be considered upon reasonable request to the authors and subject to institutional approval.
Acknowledgements
We sincerely thank all interview participants for their valuable insights and contributions to this study. We also extend our gratitude to the Swiss Federal Office of Public Health for their constructive collaboration in the preceding project. Finally, we wish to acknowledge Prof. Dr. Tobias Eule for his constructive partnership and support throughout the preceding project.
Financial support
This research did not receive any specific grant from funding agencies in the public, commercial, or not-for-profit sectors.
Competing interests
This work is partly based on the analyses of a commissioned work for the Swiss Federal Office of Public Health. The scientific study, however, is not part of this commissioned work and has been developed and written independently.
Declaration of generative AI in scientific writing
During the preparation of this work, the authors used ChatGPT (OpenAI) in order to refine the language, structure, and clarity of the manuscript, for translation purposes as well as to ensure alignment with journal guidelines. After using this tool, the authors reviewed and edited the content as needed and take full responsibility for the content of the published article.
Open access
