Privacy Assessment in Mobile Health Apps: Scoping Review

Abstract

<jats:sec> <jats:title>Background</jats:title> <jats:p>Privacy has always been a concern, especially in the health domain. The proliferation of mobile health (mHealth) apps has led to a large amount of sensitive data being generated. Some authors have performed privacy assessments of mHealth apps. They have evaluated diverse privacy components; however, different authors have used different criteria for their assessments.</jats:p> </jats:sec> <jats:sec> <jats:title>Objective</jats:title> <jats:p>This scoping review aims to understand how privacy is assessed for mHealth apps, focusing on the components, scales, criteria, and scoring methods used. A simple taxonomy to categorize the privacy assessments of mHealth apps based on component evaluation is also proposed.</jats:p> </jats:sec> <jats:sec> <jats:title>Methods</jats:title> <jats:p>We followed the methodology defined by Arksey and O’Malley to conduct a scoping review. Included studies were categorized based on the privacy component, which was assessed using the proposed taxonomy.</jats:p> </jats:sec> <jats:sec> <jats:title>Results</jats:title> <jats:p>The database searches retrieved a total of 710 citations—24 of them met the defined selection criteria, and data were extracted from them. Even though the inclusion criteria considered articles published since 2009, all the studies that were ultimately included were published from 2014 onward. Although 12 papers out of 24 (50%) analyzed only privacy, 8 (33%) analyzed both privacy and security. Moreover, 4 papers (17%) analyzed full apps, with privacy being just part of the assessment. The evaluation criteria used by authors were heterogeneous and were based on their experience, the literature, and/or existing legal frameworks. Regarding the set of items used for the assessments, each article defined a different one. Items included app permissions, analysis of the destination, analysis of the content of communications, study of the privacy policy, use of remote storage, and existence of a password to access the app, among many others. Most of the included studies provided a scoring method that enables the comparison of privacy among apps.</jats:p> </jats:sec> <jats:sec> <jats:title>Conclusions</jats:title> <jats:p>The privacy assessment of mHealth apps is a complex task, as the criteria used by different authors for their evaluations are very heterogeneous. Although some studies about privacy assessment have been conducted, a very large set of items to evaluate privacy has been used up until now. In-app information and privacy policies are primarily utilized by the scientific community to extract privacy information from mHealth apps. The creation of a scale based on more objective criteria is a desirable step forward for privacy assessment in the future.</jats:p> </jats:sec>

Analysis of Diabetes Apps to Assess Privacy-Related Permissions: Systematic Search of Apps

“…However, to the best of our knowledge, those methods have unfortunately not yet been applied to health apps. Further, there is a need for homogenous approaches for the assessment of privacy in health apps, as was highlighted recently in a scoping review addressing the issue [ 58 ].…”

COVID-19 response in low- and middle-income countries: Don’t overlook the role of mobile phone communication

“…The purpose of an automated decentralized contact tracing system is to identify contacts of a COVID-19 case, inherently requiring at least a limited amount of personal information potentially vulnerable to unauthorized access ( Bengio et al, 2020 ). A scoring method or scale to objectively assess app privacy could be a key tool for systematically comparing apps and make decisions on their use in specific settings ( Benjumea et al, 2020 ). Finally, careful precautions must be taken to avoid mobile phones themselves being a vector for virus transmission, since previous data show that respiratory viruses, including for example influenza virus, are found on up to 38% of healthcare workers’ mobile phones ( Pillet et al, 2016 ).…”

Assessment of the Quality of Mobile Applications (Apps) for Management of Low Back Pain Using the Mobile App Rating Scale (MARS)

“…Health applications (apps) handle users’ private information on health status, habits, or preferences. While any personal information must be handled with caution, health information is especially sensitive [ 50 , 51 , 52 , 53 ]. The law protects patients’ rights to the confidentiality of their health data, but such laws are usually drafted for application in the health system.…”

“…The law protects patients’ rights to the confidentiality of their health data, but such laws are usually drafted for application in the health system. Applying and monitoring compliance with these rights in mobile health (mHealth) apps is, therefore, a challenge [ 51 ]. The Mobile App Rating Scale (MARS) includes items about whether access controls have been introduced in the app using login or password options to improve privacy.…”