Privacy and Security in Mobile Health Apps: A Review and Recommendations

Abstract

In a world where the industry of mobile applications is continuously expanding and new health care apps and devices are created every day, it is important to take special care of the collection and treatment of users' personal health information. However, the appropriate methods to do this are not usually taken into account by apps designers and insecure applications are released. This paper presents a study of security and privacy in mHealth, focusing on three parts: a study of the existing laws regulating these aspects in the European Union and the United States, a review of the academic literature related to this topic, and a proposal of some recommendations for designers in order to create mobile health applications that satisfy the current security and privacy legislation. This paper will complement other standards and certifications about security and privacy and will suppose a quick guide for apps designers, developers and researchers.

The ownership and clinical use of smartphones by doctors and nurses in the UK: a multicentre survey study

“…8 Despite the enthusiasm for digital health there are pitfalls and several studies have demonstrated the potential for certain apps to cause patient harm. [9][10][11] Furthermore, the use of mobile devices in the clinical arena poses specific security and privacy challenges 12 that must be addressed in order to mitigate the risks of inadvertently breaching highly sensitive and confidential patient-identifiable data.…”

Mobile health in cardiology: a review of currently available medical apps and equipment for remote monitoring

“…Martinez-Pérez et al [63]. reviewed the standards and certifications about security and privacy in North America and the European countries.…”

“…They state that 'In practice, these laws are too open and too old, and need to be revised and reformulated taking into account the current technologies, industries and healthcare fields, focusing especially on mHealth and the mobile apps industry, which is continuously expanding.' [63] Mamlin et al [64]. also point out that the laws, in the United States, need to be updated to match the current methods for recording and transmitting data [64].…”

Modelo de evaluación de requerimientos de privacidad, seguridad y calidad de servicio para aplicaciones médicas móviles

“…Martínez et al, (9) presentó algunos requisitos legales que permiten mantener la seguridad y privacidad de la información y que se encuentran organizados en las siguientes categorías: cobertura de la información de los pacientes, requerimientos y métodos utilizados para recoger la información, requisitos de consentimiento, retención de datos, seguridad durante la adquisición, transmisión y almacenamiento de los datos y obligaciones de notificación. Arora et al, (10) analizaron los factores de riesgo en la salud móvil y plantearon posibles soluciones para mitigarlos durante los procesos de identificación, autenticación, trasmisión de la información y control de acceso.…”