Assessing Access Control Risk for mHealth: A Delphi Study to Categorize Security of Health Data and Provide Risk Assessment for Mobile Apps

Abstract

Background. Smartphones can tackle healthcare stakeholders’ diverse needs. Nonetheless, the risk of data disclosure/breach can be higher when using such devices, due to the lack of adequate security and the fact that a medical record has a significant higher financial value when compared with other records. Means to assess those risks are required for every mHealth application interaction, dependent and independent of its goals/content. Objective. To present a risk assessment feature integration into the SoTRAACE (Socio-Technical Risk-Adaptable Access Control) model, as well as the operationalization of the related mobile health decision policies. Methods. Since there is still a lack of a definition for health data security categorization, a Delphi study with security experts was performed for this purpose, to reflect the knowledge of security experts and to be closer to real-life situations and their associated risks. Results. The Delphi study allowed a consensus to be reached on eleven risk factors of information security related to mobile applications that can easily be adapted into the described SoTRAACE prototype. Within those risk factors, the most significant five, as assessed by the experts, and in descending order of risk level, are as follows: (1) security in the communication (e.g., used security protocols), (2) behavioural differences (e.g., different or outlier patterns of behaviour detected for a user), (3) type of wireless connection and respective encryption, (4) resource sensitivity, and (5) device threat level (e.g., known vulnerabilities associated to a device or its operating system). Conclusions. Building adaptable, risk-aware resilient access control models into the most generalized technology used nowadays (e.g., smartphones) is crucial to fulfil both the goals of users as well as security and privacy requirements for healthcare data.

Cyber Risk in Health Facilities: A Systematic Literature Review

“…EHR is described as the ability to store a large amount of low-cost medical records using devices and ensure better patient care [17]. Mobile health application, so-called mHealth, is the technology using to medical personnel for medical and other health-related purposes [18]. This technology allows patient care; however, it can be attacked by hackers because it has a significant financial value in terms of personal data [18].…”

“…For instance, an activity with a high damage probability is telemedicine [16]. An increasingly widespread cyber risk is that of remote access to electronic medical records patients [18]. This access can be used as a fraudulent way by hackers to access information in the databases [17].…”

The world health organization collaborating center for emergency and trauma (WHO-CCET) in South East Asia, the world academic council of emergency medicine (WACEM), and The American college of academic international medicine (ACAIM) 2021 framework for using telemedicine technology at healthcare institutions

“…In telemedicine, smartphones have many advantages in terms of addressing the diversity of needs for stakeholders including doctors, nurses, business administrators, and patients themselves. [ 27 ] Health professionals can utilize smart phones to conduct teleconsultations to manage health-care records, prescribe medications, and view examination results. [ 28 ] Smartphones can act as a remote access tool for health records for physicians and as a means for patients to access their own portal with relevant health information.…”

“…The risk of disclosure and breach is even higher for these apps as adequate cybersecurity measures are still not in place. [ 27 ] Even if the proper safeguards are in place, it is often difficult to verify the user. In addition, PHI is viewed to have a higher value than other online personal information such as credit card data, making it more attractive to hackers.…”

“…In addition, PHI is viewed to have a higher value than other online personal information such as credit card data, making it more attractive to hackers. [ 27 30 ]…”