What would bother you more: an emptied bank account or an exposed patient record? Many people would instinctively say the bank account. Yet health apps have long had an established benchmark in BSI TR-03161, and for DiGAs (prescribable digital health applications in Germany) the attestation is even mandatory. The counterpart for financial apps is BSI TR-03174 "Secure Applications in the Financial Sector", at version 4.0 since June 2026.

This article explains what BSI TR-03174 requires, who it applies to, and why experience from healthcare carries over directly.