Health app policy: international comparison of nine countries' approaches

Digital health apps promise to expand access, complement standards of care, and create value for patients, but health systems struggle to evaluate and incorporate the accelerating stream of new tools. The central problem is helping clinicians, patients, and payers identify safe and effective apps and guiding reimbursement decisions. Many stakeholders call for frameworks that provide a quality “stamp” or labeling for apps that meet baseline medical and privacy criteria, and standard-setting bodies (e.g., CEN/ISO) encourage countries to develop such frameworks. The study’s objective is to compare national policy approaches for health apps across nine countries with advanced health and regulatory systems, identifying commonalities, differences, and forward-looking recommendations to support future policy development.

Design: Cross-country comparative policy analysis focused on national-level policy content for health apps. Scope: Seven European countries plus the United States and Singapore (Sweden, Norway, Denmark, Netherlands, Belgium, Germany, England, United States, Singapore). Selection: Purposive sampling of countries with notable progress but varying approaches; excluded countries without direct access and subnational/local frameworks. Framework: Guided by an analytic model distinguishing policy context, process, and content, with this study focusing on policy content (who/what is regulated). Data sources: Systematic document review of hard and soft laws, national strategies, e-health reports, and standards (mid-2021, Q2–Q3), complemented by 14 interviews with key individuals involved in framework development. Data handling: Country leads compiled materials and populated a structured framework; entries were double-checked and iteratively revised by the first and last authors through September 2021. Subsequent regulatory changes post-September 2021 were not included.

• Countries are converging on centralized approval pathways for health apps, with some exploring decentralized or federated elements (e.g., accreditation of evaluators).
• Belgium and Germany are the most advanced in operationalizing national market access and reimbursement pathways for medical apps:
  • Germany: BfArM Fast-Track for DiGA; approved apps listed in a national directory; listing implies reimbursement for patients in statutory health insurance; access often requires activation codes.
  • Belgium: mHealthBelgium three-level validation (M1 regulatory, M2 privacy/security, M3 financing/reimbursement); level 3 links to reimbursement.
  • England: Emerging approach combining DTAC and NICE evidence standards; reimbursement pathway not yet incorporated.
• Many countries’ frameworks align with EU MDR, GDPR, and emerging ISO standards (e.g., ISO 82304-2), while the US takes an FDA risk-based approach and Singapore requires HSA approval.
• As of early September 2021, despite robust processes, few apps had achieved reimbursement approval: approximately 20 in Germany and 1 in Belgium.
• Common criteria domains across frameworks: transparency (intended use, trials, compliance), health content (evidence requirements varying by purpose/risk), technology (robustness, interoperability with EHRs), security/privacy (GDPR/HIPAA), and usability (user-centered design, accessibility; German DiGA requires proof of ease of use).
• Interoperability with EHRs is prioritized (e.g., Germany, Belgium, England), but implementation and automated testing remain challenging; many apps still do not exchange data with EHRs.
• Privacy/security expectations differ: GDPR offers broad protections in the EU; the US HIPAA scope is narrower; Germany has data protections exceeding GDPR in some respects.
• Key challenges identified: reimbursement mechanisms (often absent), safety and quality of information, privacy/security operationalization, usability for diverse populations, continuous updating and maintenance, accountability and integration into care pathways, and international transferability of approvals.
• End-user interfaces (clinician-facing directories, prescription mechanisms, patient-facing search and labeling) are immature; ISO-driven in-app labels and search functions are proposed to aid selection.

The study addresses how nine countries are developing policy mechanisms to evaluate, approve, and reimburse health apps. Most favor centralized evaluation for trust and consistency, but such models risk bottlenecks given the vast number of apps and limited throughput; hybrid models with accredited evaluators may mitigate this. Frameworks often focus on medical device-classified apps (SaMD), leaving a gap for wellness apps that may provide value without meeting medical device criteria; ISO-based labeling or “nutrition label” concepts could guide consumers for these lower-risk products. Evidence standards vary by app purpose and risk; beyond RCTs, structural and procedural outcomes and real-world evidence will be needed, and mutual recognition across countries could reduce burdens, especially for small markets or rare diseases. Interoperability with EHRs is widely desired but technically and operationally difficult; standardized testing and APIs are needed. Privacy/security criteria are anchored in GDPR in Europe and HIPAA in the US, but operational details (e.g., cybersecurity disclosures, consent clarity, incident signaling) are under-specified. Usability is critical yet variably assessed; crowdsourced ratings could complement centralized evaluations while recognizing risks of gaming. Continuous updating of software and content and accountability for side effects and care pathway integration are underdeveloped areas. Overall, achieving balance between rigorous criteria and practical, scalable frameworks may require staged models, with increasing requirements aligned to app risk and intended use, and better-designed end-user interfaces for clinicians, patients, and payers.

National efforts to regulate, evaluate, and reimburse health apps are advancing, with Belgium and Germany demonstrating operational frameworks and other countries developing convergent criteria around transparency, evidence, interoperability, security, and usability. However, implementation challenges persist, including evaluation bottlenecks, limited interoperability in practice, privacy/security operationalization, usability, maintenance, accountability, and immature end-user interfaces. A staged, risk-based approach that combines centralized approvals with accredited decentralized evaluations, standardized labeling (e.g., ISO 82304-2), and clear pathways for app prescription and reimbursement is recommended. International collaboration could enable evidence transferability, harmonized criteria, improved cybersecurity and privacy practices, and shared approaches to RWE and ongoing monitoring, accelerating safe, effective app adoption and integration into care.

• Scope limited to mobile health apps (excluding broader digital health and hardware) and national-level policies; subnational and community-developed frameworks were excluded.
• Only nine countries were studied, selected for diversity and relative advancement; findings may not generalize globally.
• Data reflect documents and interviews available through September 2021; subsequent policy changes are not captured.
• Analyses focus on policy content; implementation effectiveness and outcomes were not formally evaluated.