Unaddressed privacy risks in accredited health and wellness apps: a cross-sectional systematic assessment

Abstract

BackgroundPoor information privacy practices have been identified in health apps. Medical app accreditation programs offer a mechanism for assuring the quality of apps; however, little is known about their ability to control information privacy risks. We aimed to assess the extent to which already-certified apps complied with data protection principles mandated by the largest national accreditation program.MethodsCross-sectional, systematic, 6-month assessment of 79 apps certified as clinically safe and trustworthy by the UK NHS Health Apps Library. Protocol-based testing was used to characterize personal information collection, local-device storage and information transmission. Observed information handling practices were compared against privacy policy commitments.ResultsThe study revealed that 89 % (n = 70/79) of apps transmitted information to online services. No app encrypted personal information stored locally. Furthermore, 66 % (23/35) of apps sending identifying information over the Internet did not use encryption and 20 % (7/35) did not have a privacy policy. Overall, 67 % (53/79) of apps had some form of privacy policy. No app collected or transmitted information that a policy explicitly stated it would not; however, 78 % (38/49) of information-transmitting apps with a policy did not describe the nature of personal information included in transmissions. Four apps sent both identifying and health information without encryption. Although the study was not designed to examine data handling after transmission to online services, security problems appeared to place users at risk of data theft in two cases.ConclusionsSystematic gaps in compliance with data protection principles in accredited health apps question whether certification programs relying substantially on developer disclosures can provide a trusted resource for patients and clinicians. Accreditation programs should, as a minimum, provide consistent and reliable warnings about possible threats and, ideally, require publishers to rectify vulnerabilities before apps are released.Electronic supplementary materialThe online version of this article (doi:10.1186/s12916-015-0444-y) contains supplementary material, which is available to authorized users.

An Australian survey of women's use of pregnancy and parenting apps

“…This practice often leads to data leakage, where the data obtained are used for commercial purposes by the app developers or agencies to which they on-sell the data 24 . Many of the most popular health and medical apps send data unencrypted, thus rendering personal data open to hacking 25 .…”

Mental health: There’s an app for that

“…A separate analysis 11 found that 35 of the mobile health apps originally listed by the NHS transmitted identifying information -such as e-mail addresses, names and birthdates -about users over the Internet, and two-thirds of these did not encrypt the data.…”

Quality of Publicly Available Physical Activity Apps: Review and Content Analysis (Preprint)

“…Our results are consistent with previous studies assessing data safety. Huckvale, Prieto [8] who assessed the apps from the NHS Apps Library, found that 20% of apps did not have privacy policy, and most of the apps breached users' data privacy and security. Collecting and analyzing consumer data by app developers can have advantages for the users, such as personalization and improvement of the products [35].…”

“…Third, data privacy and security assessment was limited to the analysis of the policy. There is evidence of inconsistency between the policy statement and the actual practices of app developers [8].…”

“…Within the new digital health care landscape, the rise of apps creates novel prospects for prevention opportunities and disease management [8]. Mobile health apps, as opposed to traditional face to face interventions, are more accessible [9], and provide a range of technology enhanced features, such as accelerometers, visualizations, tailored feedback and reminders.…”