Are there general authentication requirements for patient mobile applications under MDR?

Question

Are there any general guidelines or requirements under the Medical Device Regulation (MDR) for authentication in patient-facing mobile applications?
I am specifically interested in requirements that would apply across multiple markets, not country-specific identity verification rules. I have found that the MDCG cybersecurity guideline only mentions 'sufficiently complex passwords', which seems vague. Are there more concrete or widely accepted standards, or is this generally left open to interpretation?

Dr. Oliver Eidel · Accepted Answer

Overall, MDR does not specify detailed authentication requirements for patient mobile applications. The MDCG cybersecurity guidance mainly suggests using 'sufficiently complex passwords,' which is quite general. Most of the specifics are left open, and there are no concrete requirements that apply across all markets under MDR.
For certain countries, like Germany (e.g., for DiGA applications), there are stricter requirements such as two-factor authentication, but these are local rules rather than MDR-wide. For a scalable approach, you might want to follow best practices like offering two-factor authentication and secure password policies, but MDR itself does not mandate specifics.

Answer

There's a product standard in Germany, BSI TR 03161, for digital health applications. It's quite detailed, although maybe more than needed for MDR compliance. It can offer some guidance if you want to go beyond the basics, but keep in mind it's a national, not EU-wide, requirement. The current official version is only in German but may provide helpful ideas.

Are there general authentication requirements for patient mobile applications under MDR?

2 Answers

Keep reading

How is medical device regulation developed and how can its usability be improved for start-ups?

Do We Need a User Manual for Our Software as a Medical Device?

How can the usability of the MDR and related standards be improved for startups?