The implementation of BSI TR-03161, which is mandatory for DiGA, is causing considerable dissatisfaction among patients.
Automatic logout from the app after inactivity or the complicated setup of two-factor authentication overwhelms many users, for example. One reason cited is the technical terminology that comes with the new security requirements: not everyone can reliably tell what a PIN, a TAN or an ID card number is at the relevant step of registration or login.
The BSI, meanwhile, has given assurances that it will take feedback from manufacturers and test bodies into account in the ongoing revision of the guideline.
Handelsblatt reports on the feedback from various DiGA manufacturers: DiGA: Datenschutz versus Nutzerfreundlichkeit? BSI-Richtlinie verunsichert