Digital signatures and FSE 2.0: how they work, who needs one, how to get one

Digital signatures and FSE 2.0: what every doctor needs to know

Of all the technical requirements FSE 2.0 brings, the digital signature is probably the one that causes the most confusion — and the most delay. Yet there is no way round it: without a personal digital signature, no document can be sent to the Electronic Health Record at all.

Why a digital signature is mandatory

The rules are clear on this point: every clinical document sent to FSE 2.0 must be digitally signed by the doctor who wrote it. Not by the organisation they work for, not by the IT administrator: by the professional responsible for the document.

There is a precise logic to this. A digital signature carries the same legal weight as a handwritten one and guarantees three essential things:authenticity of the document (that doctor really did produce it), theintegrity of the content (nobody altered it after signing) and non-repudiation (signers cannot deny having signed).

In a system like the FSE, where documents travel between regions and are read by professionals who have never met the patient, these guarantees are essential.

What a CAdES signature is

The standard required for FSE 2.0 documents is the CAdES (CMS Advanced Electronic Signatures), one of the advanced electronic signature formats recognised across Europe under the eIDAS Regulation.

Unlike other formats such as PAdES, used for PDFs, a CAdES signature wraps the signed document inside a file with the extension .p7m. This is the format Italy's regional FSE gateways recognise and accept.

How signing works in practice

A CAdES signature is applied using a physical device — typically a USB token (a small key) or a smart card — which holds the professional's signing certificate. The doctor connects the device to the computer, enters their personal PIN, and the practice management software signs the document before sending it.

One practical point matters a great deal: the token works from any computer. A doctor can sign from the practice, from home, from anywhere with a computer and an internet connection. There is no need to be in a specific place.

Who needs a signature, and who does not have one yet

Every doctor who produces documents for the FSE needs their own personal digital signature. A multi-specialty clinic with five specialists needs five tokens, one per professional.

In practice, digital signatures are still uncommon among Italian clinicians — more so among general practitioners, who adopted them for paperless prescriptions, than among specialists in private outpatient practice.

Checking how many of the practice's professionals already hold a digital signature is the first thing to do.

How to obtain a digital signature

The main certified providers in Italy are Aruba (aruba.it) and Namirial (namirial.com), both accredited with AgID, Italy's Digital Agency. A USB token with a digital signature generally costs between 25 and 60 euros, with annual renewal fees that vary.

Activation requires the applicant's identity to be verified — in person, through SPID, or by video call — and usually takes two to five working days.

Certified archiving: the next step

One point tied directly to digital signatures is the certified archiving. The law requires every digitally signed document to be kept for at least ten years in certified systems. Saving them on the practice's own server is not enough: you need an archiving service run by an accredited provider.

This is a service on top of sending to the FSE, but it is an integral part of what digitising healthcare requires.