Mobile Mental Health: Navigating New Rules and Regulations for Digital Tools

Abstract

Mobile health (mHealth) apps are becoming much more widely available. As more patients learn about and download apps, clinicians are sure to face more questions about the role these apps can play in treatment. Clinicians thus need to familiarize themselves with the clinical and legal risks that apps may introduce. Regulatory rules and organizations that oversee the safety and efficacy of mHealth apps are currently fragmentary in nature and clinicians should pay special attention to categories of apps which are currently exempt from significant regulation. Uniform HIPAA protection does not apply to personal health data that are shared with apps in many contexts which creates a number of clinically relevant privacy and security concerns. Clinicians should also consider several relatively novel potential adverse clinical outcomes and liability concerns that may be relevant to specific categories of apps, including apps that target (i) medication adherence, (ii) collection of self-reported data, (iii) collection of passive data, and (iv) generation of treatment recommendations for psychotherapeutic and behavioral interventions. Considering these potential pitfalls (and disclosing them to patients as a part of obtaining informed consent) is necessary as clinicians consider incorporating apps into treatment.

‘Help for trauma from the app stores?’ A systematic review and standardised rating of apps for Post-Traumatic Stress Disorder (PTSD)

“…Even more concerning is the fact that many apps transmit data to commercial entities without disclosing this (Huckvale, Torous, & Larsen, 2019). This constitutes a serious threat to patients' data privacy and illustrates the need for developers to be more strictly bound to security, data protection, and privacy regulations (Armontrout, Torous, Fisher, Drogin, & Gutheil, 2016). Until then, clinicians and consumers need to be careful when using apps (Armontrout et al, 2016).…”

Ethical perspectives on recommending digital technology for patients with mental illness

“…The classification of individuals based on big data may have long-lasting and negative non-medical impacts (Executive Office 2016 ; FTC 2016a ). The use of unvalidated apps, medical websites with poor quality information, or self-diagnosis and self-treatment may lead to medical risks, including a delay in seeking professional help (Ryan and Wilson 2008 ; Armontrout et al 2016 ). Traditional societal concepts of what data are public versus private data, and medical versus non-medical are blurring (Tene and Polonetsky 2013 ; Monteith and Glenn 2016 ; Friedland 2015 ).…”

“…This discussion only provides a limited list of the ethical challenges and does not offer specific solutions to these complex problems. Many significant issues were omitted such as how patient monitoring systems handle data that are inadvertently captured about other people such as facial images, voice recordings, and metadata (Rana et al 2016 ), and new legal issues such as timeliness of response to monitoring data (Armontrout et al 2016 ). Other issues that were omitted include whether health-related chatbots (automated conversational software) should deceive patients into thinking they are interacting with a human (Whitby 2014 ), the coming of medications with sensors for adherence monitoring (Kane et al 2013 ), the monitoring of people with dementia (Niemeijer et al 2011 ), and the evaluation of long-term clinical value.…”

Developments in Privacy and Data Ownership in Mobile Health Technologies, 2016-2019

“…The HITECH Act of 2009 subsequently enhanced penalties for HIPAA violations, expanded enforcement, and added a data breach notification requirement [9,26]. HIPAA has a number of limitations, including the fact that it does not cover all medical records (only those maintained by certain types of record holders) and that it does not cover all parties that possess medical information [9,27,28]. It is therefore important to note that HIPAA does not cover many websites that gather health information [9].…”