Exploring the far side of mobile health: Information security and privacy of mobile health apps on ios and android

JMIR mHealth and uHealth

Volumn 3, Issue 1, 2015, Pages

  Dehling, Tobias ^a   Inf, Dipl Wirt ^a   Gao, Fangjian ^a   Schneider, Stephan ^a   Sunyaev, Ali ^a  

^a UNIVERSITY OF COLOGNE   (Germany)

Author keywords

Data security; Health information technology; Mobile apps; Mobile health; Patient privacy; Software and application security

Indexed keywords

EID: 85091527007     PISSN: None     EISSN: 22915222     Source Type: Journal    
DOI: 10.2196/mhealth.3672     Document Type: Article

References (95)

1. Collins F. Sci Am. 2012 Jul 10. The real promise of mobile health appsURL: http://www.scientificamerican.com/article/real-promise-mobile-health-apps/ [accessed 2014-12-29] [WebCite Cache ID 6VBe0HmL4]
2. Steinhubl SR, Muse ED, Topol EJ. Can mobile health technologies transform health care? JAMA 2013 Dec 11;310(22):2395-2396. [doi: 10.1001/jama.2013.281078] [Medline: 24158428]
3. Kumar S, Nilsen W, Pavel M, Srivastava M. Mobile health: Revolutionizing healthcare through transdisciplinary research. Computer 2013 Jan;46(1):28-35. [doi: 10.1109/MC.2012.392]
4. Mechael PN. The case for mHealth in developing countries. Innovations: Technology, Governance, Globalization 2009 Jan;4(1):103-118. [doi: 10.1162/itgg.2009.4.1.103]
5. Istepanian R, Jovanov E, Zhang YT. Introduction to the special section on M-Health: Beyond seamless mobility and global wireless health-care connectivity. IEEE Trans Inf Technol Biomed 2004 Dec;8(4):405-414. [Medline: 15615031]
6. Sunyaev A. Consumer facing health care systems. e-Service Journal 2014 Jan;9(2):1-23. [doi: 10.2979/eservicej.9.2.1]
7. Anthes G. HTML5 leads a web revolution. Commun. ACM 2012 Jul 01;55(7):16-17. [doi: 10.1145/2209249.2209256]
8. d'Heureuse N, Huici F, Arumaithurai M, Ahmed M, Papagiannaki K, Niccolini S. What's app? SIGMOBILE Mob. Comput. Commun. Rev 2012 Nov 12;16(2):16-27. [doi: 10.1145/2396756.2396759]
9. Muñoz R. Using evidence-based internet interventions to reduce health disparities worldwide. J Med Internet Res 2010;12(5):e60 [FREE Full text] [doi: 10.2196/jmir.1463] [Medline: 21169162]
10. Chomutare T, Fernandez-Luque L, Arsand E, Hartvigsen G. Features of mobile diabetes applications: Review of the literature and analysis of current applications compared against evidence-based guidelines. J Med Internet Res 2011;13(3):e65 [FREE Full text] [doi: 10.2196/jmir.1874] [Medline: 21979293]
11. Martínez-Pérez B, de la Torre-Díez I, López-Coronado M. Mobile health applications for the most prevalent conditions by the World Health Organization: Review and analysis. J Med Internet Res 2013;15(6):e120 [FREE Full text] [doi: 10.2196/jmir.2600] [Medline: 23770578]
12. Chen C, Haddad D, Selsky J, Hoffman JE, Kravitz RL, Estrin DE, et al. Making sense of mobile health data: An open architecture to improve individual- and population-level health. J Med Internet Res 2012;14(4):e112 [FREE Full text] [doi: 10.2196/jmir.2152] [Medline: 22875563]
13. Simon SR, Evans JS, Benjamin A, Delano D, Bates DW. Patients' attitudes toward electronic health information exchange: Qualitative study. J Med Internet Res 2009;11(3):e30 [FREE Full text] [doi: 10.2196/jmir.1164] [Medline: 19674960]
14. Dhopeshwarkar RV, Kern LM, O'Donnell HC, Edwards AM, Kaushal R. Health care consumers' preferences around health information exchange. Ann Fam Med 2012;10(5):428-434 [FREE Full text] [doi: 10.1370/afm.1396] [Medline: 22966106]
15. Khalid H, Shihab E, Nagappan M, Hassan A. What do mobile app users complain about? A study on free iOS apps. IEEE Softw 2014;PrePrints:1-1. [doi: 10.1109/MS.2014.50]
16. Bélanger F, Crossler RE. MIS Q. 2011. Privacy in the digital age: A review of information privacy research in information systemsURL: http://misq.org/cat-articles/privacy-in-the-digital-age-a-review-of-information-privacy-research-in-information-systems.html [accessed 2015-01-12] [WebCite Cache ID 6VbJ8Iq6s]
17. Anderson CL, Agarwal R. The digitization of healthcare: Boundary risks, emotion, and consumer willingness to disclose personal health information. Information Systems Research 2011 Sep;22(3):469-490. [doi: 10.1287/isre.1100.0335]
18. Avancha S, Baxi A, Kotz D. Privacy in mobile technology for personal healthcare. ACM Comput. Surv 2012 Nov 01;45(1):1-54. [doi: 10.1145/2379776.2379779]
19. Lane N, Miluzzo E, Lu H, Peebles D, Choudhury T, Campbell A. A survey of mobile phone sensing. IEEE Commun. Mag 2010 Sep;48(9):140-150. [doi: 10.1109/MCOM.2010.5560598]
20. Weiss GM, Lockhart JW. The impact of personalization on smartphone-based activity recognition. 2012 Presented at: Proc Act Context Represent Workshop; July 22-23, 2012; Toronto, Canada p. 98-104 URL: http://www.aaai.org/ocs/index.php/WS/AAAIW12/paper/viewFile/5203/5564
21. Apple. 2014. Apple iTunes App StoreURL: https://itunes.apple.com/us/genre/ios/id36?mt=8 [accessed 2014-12-29] [WebCite Cache ID 6VBeRBI0n]
22. Google. 2014. Google Play App StoreURL: https://play.google.com/store/apps [accessed 2014-12-29] [WebCite Cache ID 6VBeUxkIm]
23. Barak A, Klein B, Proudfoot JG. Defining internet-supported therapeutic interventions. Ann Behav Med 2009 Aug;38(1):4-17. [doi: 10.1007/s12160-009-9130-7] [Medline: 19787305]
24. Enck W, Octeau D, McDaniel P, Chaudhuri S. A study of Android application security. USA: USENIX Association; 2011. A study of Android application securityURL: http://static.usenix.org/legacy/events/sec11/tech/full_papers/Enck.pdf [accessed 2015-01-12] [WebCite Cache ID 6VbJsumQl]
25. Goth G. Analyzing medical data. Commun. ACM 2012 Jun 01;55(6):13-15. [doi: 10.1145/2184319.2184324]
26. Chin E, Felt AP, Greenwood K, Wagner D. Analyzing inter-application communication in Android. USA: ACM; 2011 Presented at: Int Conf Mob Syst Appl Serv; June 28 - July 1, 2011; Washington, DC, USA p. 239-252. [doi: 10.1145/1999995.2000018]
27. Egele M, Kruegel C, Kirda E, Vigna G. PiOS: Detecting privacy leaks in iOS applications. USA: The Internet Society; 2011 Presented at: Netw Distrib Syst Secur Symp; February 6-9, 2011; San Dieg0, CA, USA URL: http://www.internetsociety.org/sites/default/files/egel.pdf
28. Wicker SB. The loss of location privacy in the cellular age. Commun. ACM 2012 Aug 01;55(8):60-68. [doi: 10.1145/2240236.2240255]
29. Liccardi I, Pato J, Weitzner DJ. J Priv Confidentiality. 2013. Improving mobile app selection through transparency and better permission analysisURL: http://repository.cmu.edu/cgi/viewcontent.cgi?article=1102&context=jpc [accessed 2015-01-12] [WebCite Cache ID 6VbKZXQeN] 30. Estrin D, Sim I. Health care delivery. Open mHealth architecture: An engine for health care innovation. Science 2010 Nov 5;330(6005):759-760. [doi: 10.1126/science.1196187] [Medline: 21051617]
30. Heitkötter H, Majchrzak TA, Kuchen H. Cross-platform model-driven development of mobile applications with md2. USA: ACM; 2013 Presented at: Annu ACM Symp Appl Comput; March 18-22, 2013; Coimbra, Portugal p. 526-533. [doi: 10.1145/2480362.2480464]
31. Mojica IJ, Adams B, Nagappan M, Dienst S, Berger T, Hassan AE. A large-scale empirical study on software reuse in mobile apps. IEEE Softw 2014 Mar;31(2):78-86. [doi: 10.1109/MS.2013.142]
32. Freifeld CC, Chunara R, Mekaru SR, Chan EH, Kass-Hout T, Ayala Iacucci A, et al. Participatory epidemiology: Use of mobile phones for community-based health reporting. PLoS Med 2010;7(12):e1000376 [FREE Full text] [doi: 10.1371/journal.pmed.1000376] [Medline: 21151888]
33. Ozdalga E, Ozdalga A, Ahuja N. The smartphone in medicine: A review of current and potential use among physicians and students. J Med Internet Res 2012;14(5):e128 [FREE Full text] [doi: 10.2196/jmir.1994] [Medline: 23017375]
34. Pathak A, Hu YC, Zhang M. Where is the energy spent inside my App?: Fine grained energy accounting on smartphones with Eprof. USA: ACM; 2012 Presented at: ACM Eur Conf Comput Syst; April 10-13, 2012; Bern, Switzerland p. 29-42. [doi: 10.1145/2168836.2168841]
35. Xu Q, Erman J, Gerber A, Mao ZM, Pang J, Venkataraman S. Identifying diverse usage behaviors of smartphone apps. USA: ACM; 2011 Presented at: ACM SIGCOMM Conf Internet Meas Conf; November 2-4, 2011; Berlin, Germany p. 329-344. [doi: 10.1145/2068816.2068847]
36. Xu H, Gupta S, Rosson MB, Carroll JM. Measuring mobile users' concerns for information privacy. 2012 Presented at: Int Conf Inf Syst; December 16-19, 2012; Orlando, FL, USA URL: http://aisel.aisnet.org/cgi/viewcontent.cgi?article=1108&context=icis2012
37. Food and Drug Administration. Mobile medical applications - guidance for industry and food and drug administration staff. USA: Food and Drug Administration; 2013. URL: http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM263366.pdf [accessed 2015-01-01] [WebCite Cache ID 6VGNj7A6h]
38. European Commision. Proposal for a regulation of the European Parliament and of the council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (general data protection regulation). Brussels, Belgium: European Commission; 2012. URL: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52012PC0011&from=en [accessed 2015-01-01] [WebCite Cache ID 6VGO0XR8G]
39. West JH, Hall PC, Hanson CL, Barnes MD, Giraud-Carrier C, Barrett J. There's an app for that: Content analysis of paid health and fitness apps. J Med Internet Res 2012;14(3):e72 [FREE Full text] [doi: 10.2196/jmir.1977] [Medline: 22584372]
40. Plaza I, Demarzo MM, Herrera-Mercadal P, García-Campayo J. Mindfulness-based mobile applications: Literature review and analysis of current features. JMIR Mhealth Uhealth 2013;1(2):e24 [FREE Full text] [doi: 10.2196/mhealth.2733] [Medline: 25099314]
41. Martínez-Pérez B, de la Torre-Díez I, López-Coronado M, Herreros-González J. Mobile apps in cardiology: Review. JMIR Mhealth Uhealth 2013 Jul 24;1(2):e15 [FREE Full text] [doi: 10.2196/mhealth.2737]
42. Bierbrier R, Lo V, Wu RC. Evaluation of the accuracy of smartphone medical calculation apps. J Med Internet Res 2014;16(2):e32 [FREE Full text] [doi: 10.2196/jmir.3062] [Medline: 24491911]
43. Bender JL, Yue RY, To MJ, Deacken L, Jadad AR. A lot of action, but not in the right direction: Systematic review and content analysis of smartphone applications for the prevention, detection, and management of cancer. J Med Internet Res 2013;15(12):e287 [FREE Full text] [doi: 10.2196/jmir.2661] [Medline: 24366061]
44. Donker T, Petrie K, Proudfoot J, Clarke J, Birch MR, Christensen H. Smartphones for smarter delivery of mental health programs: A systematic review. J Med Internet Res 2013;15(11):e247 [FREE Full text] [doi: 10.2196/jmir.2791] [Medline: 24240579]
45. Muessig KE, Pike EC, Legrand S, Hightow-Weidman LB. Mobile phone applications for the care and prevention of HIV and other sexually transmitted diseases: A review. J Med Internet Res 2013;15(1):e1 [FREE Full text] [doi: 10.2196/jmir.2301] [Medline: 23291245]
46. Mosa AS, Yoo I, Sheets L. A systematic review of healthcare applications for smartphones. BMC Med Inform Decis Mak 2012;12:67 [FREE Full text] [doi: 10.1186/1472-6947-12-67] [Medline: 22781312]
47. Martínez-Pérez B, de la Torre-Díez I, López-Coronado M, Sainz-De-Abajo B. Comparison of mobile apps for the leading causes of death among different income zones: A review of the literature and app stores. JMIR Mhealth Uhealth 2014;2(1):e1 [FREE Full text] [doi: 10.2196/mhealth.2779] [Medline: 25099695]
48. Huckvale K, Car M, Morrison C, Car J. Apps for asthma self-management: A systematic assessment of content and tools. BMC Med 2012;10:144 [FREE Full text] [doi: 10.1186/1741-7015-10-144] [Medline: 23171675]
49. Wolf JA, Moreau JF, Akilov O, Patton T, English JC, Ho J, et al. Diagnostic inaccuracy of smartphone applications for melanoma detection. JAMA Dermatol 2013 Apr;149(4):422-426 [FREE Full text] [doi: 10.1001/jamadermatol.2013.2382] [Medline: 23325302]
50. Breton ER, Fuemmeler BF, Abroms LC. Weight loss-there is an app for that! But does it adhere to evidence-informed practices? Transl Behav Med 2011 Dec;1(4):523-529 [FREE Full text] [doi: 10.1007/s13142-011-0076-5] [Medline: 24073074]
51. Rosser BA, Eccleston C. Smartphone applications for pain management. J Telemed Telecare 2011;17(6):308-312. [doi: 10.1258/jtt.2011.101102] [Medline: 21844177]
52. Abroms LC, Padmanabhan N, Thaweethai L, Phillips T. iPhone apps for smoking cessation: A content analysis. Am J Prev Med 2011 Mar;40(3):279-285 [FREE Full text] [doi: 10.1016/j.amepre.2010.10.032] [Medline: 21335258]
53. Liu C, Zhu Q, Holroyd KA, Seng EK. Status and trends of mobile-health applications for iOS devices: A developer's perspective. Journal of Systems and Software 2011 Nov;84(11):2022-2033. [doi: 10.1016/j.jss.2011.06.049]
54. Lewis TL, Wyatt JC. mHealth and mobile medical Apps: A framework to assess risk and promote safer use. J Med Internet Res 2014;16(9):e210 [FREE Full text] [doi: 10.2196/jmir.3133] [Medline: 25223398]
55. android-market-api. 2014. An open-source API for the Android marketURL: http://code.google.com/p/android-market-api/ [accessed 2014-02-14] [WebCite Cache ID 6NNh225JS]
56. Viennot N, Garcia E, Nieh J. A measurement study of Google Play. USA: ACM; 2014 Presented at: ACM Int Conf Meas Model Comput Syst; June 16-20, 2014; Austin, TX, USA p. 221-233. [doi: 10.1145/2591971.2592003]
57. SIL International Linguistics Department. English wordlists. 2014. URL: http://www-01.sil.org/linguistics/wordlists/english/ [accessed 2014-02-17] [WebCite Cache ID 6NS0EItXU]
58. Faro S, Lecroq T. Festschr Bo ivoj Melichar Prague, Czech Republic. Prague, Czech Republic: Prague Stringology Club; 2012. Twenty years of bit-parallelism in string matchingURL: http://www.stringology.org/papers/Festschrift_BM70.pdf [accessed 2015-01-07] [WebCite Cache ID 6VPW34gIe]
59. Jain AK. Data clustering: 50 years beyond K-means. Pattern Recognition Letters 2010 Jun;31(8):651-666. [doi: 10.1016/j.patrec.2009.09.011]
60. Newman MEJ. The structure and function of complex networks. SIAM Rev 2003 Jan;45(2):167-256. [doi: 10.1137/S003614450342480]
61. Blondel VD, Guillaume J, Lambiotte R, Lefebvre E. Fast unfolding of communities in large networks. J. Stat. Mech 2008 Oct 09;2008(10):P10008. [doi: 10.1088/1742-5468/2008/10/P10008]
62. Newman ME, Girvan M. Finding and evaluating community structure in networks. Phys Rev E Stat Nonlin Soft Matter Phys 2004 Feb;69(2 Pt 2):026113. [Medline: 14995526]
63. Lancichinetti A, Fortunato S. Community detection algorithms: A comparative analysis. Phys Rev E Stat Nonlin Soft Matter Phys 2009 Nov;80(5 Pt 2):056117. [Medline: 20365053]
64. Tibély G, Kovanen L, Karsai M, Kaski K, Kertész J, Saramäki J. Communities and beyond: Mesoscopic analysis of a large social network with complementary methods. Phys Rev E Stat Nonlin Soft Matter Phys 2011 May;83(5 Pt 2):056125. [Medline: 21728623]
65. Naveh B. 2003. JGraphTURL: http://jgrapht.org/ [accessed 2014-02-21] [WebCite Cache ID 6NYMn4Z4V]
66. Bakhtiyari Shahri A. A tree model for identification of threats as the first stage of risk assessment in HIS. JIS 2012;03(02):169-176. [doi: 10.4236/jis.2012.32020]
67. Kotz D. A threat taxonomy for mHealth privacy. Bangalore, India: IEEE; 2011 Presented at: Int Conf Commun Syst Netw; Jan 4-8, 2011; Bangalore, India. [doi: 10.1109/COMSNETS.2011.5716518]
68. Goth G. Mobile security issues come to the forefront. IEEE Internet Comput 2012 May;16(3):7-9. [doi: 10.1109/MIC.2012.54]
69. Dehling T, Sunyaev A. Secure provision of patient-centered health information technology services in public networks-leveraging security and privacy features provided by the German nationwide health information technology infrastructure. Electron Markets 2014 Feb 8;24(2):89-99. [doi: 10.1007/s12525-013-0150-6]
70. Rindfleisch TC. Privacy, information technology, and health care. Commun. ACM 1997;40(8):92-100. [doi: 10.1145/257874.257896]
71. Rohm AJ, Milne GR. Just what the doctor ordered. Journal of Business Research 2004 Sep;57(9):1000-1011. [doi: 10.1016/S0148-2963(02)00345-4]
72. Johnson ME. Data hemorrhages in the health-care sector. In: Dingledine R, Golle P, editors. Financial Cryptography and Data Security: 13th International Conference, FC 2009, Accra Beach, Barbados, February 23-26, 2009. Revised Selected Papers... Computer Science / Security and Cryptology). USA: Springer; 2009.
73. Appari A, Johnson ME. Information security and privacy in healthcare: Current state of research. IJIEM 2010;6(4):279-314. [doi: 10.1504/IJIEM.2010.035624]
74. Appelbaum PS. Privacy in psychiatric treatment: Threats and responses. Am J Psychiatry 2002 Nov;159(11):1809-1818. [Medline: 12411211]
75. Gritzalis DA. Enhancing security and improving interoperability in healthcare information systems. Med Inform (Lond) 1998;23(4):309-323. [Medline: 9922951]
76. Shea S. Security versus access: Trade-offs are only part of the story. J Am Med Inform Assoc 1994;1(4):314-315 [FREE Full text] [Medline: 7719814]
77. Barrows RC, Clayton PD. Privacy, confidentiality, and electronic medical records. J Am Med Inform Assoc 1996;3(2):139-148 [FREE Full text] [Medline: 8653450]
78. Rothstein MA, Talbott MK. Compelled authorizations for disclosure of health records: Magnitude and implications. Am J Bioeth 2007 Mar;7(3):38-45. [doi: 10.1080/15265160601171887] [Medline: 17366232]
79. Janson H, Olsson U. A measure of agreement for interval or nominal multivariate observations. Educational and Psychological Measurement 2001 Apr 01;61(2):277-289. [doi: 10.1177/00131640121971239]
80. Landis JR, Koch GG. The measurement of observer agreement for categorical data. Biometrics 1977 Mar;33(1):159-174. [Medline: 843571]
81. Merriam-Webster. 2014. Archetype - definitionURL: http://www.merriam-webster.com/dictionary/archetype [accessed 2014-06-26] [WebCite Cache ID 6QdwYwRgI]
82. Newman ME. Analysis of weighted networks. Phys Rev E Stat Nonlin Soft Matter Phys 2004 Nov;70(5 Pt 2):056131. [Medline: 15600716]
83. Girardello A, Michahelles F. Explicit and implicit ratings for mobile applications. Germany: GI; 2010 Presented at: Informatik 2010; September 29 - October 1, 2010; Leipzig, Germany p. 606-612 URL: http://subs.emis.de/LNI/Proceedings/Proceedings175/606.pdf
84. Pagano D, Maalej W. User feedback in the AppStore: An empirical study.: IEEE; 2013 Presented at: IEEE International Conference on Requirements Engineering; July 15-19, 2013; Rio De Janeiro, Brasil p. 125-134. [doi: 10.1109/RE.2013.6636712]
85. Caligtan CA, Dykes PC. Electronic health records and personal health records. Semin Oncol Nurs 2011 Aug;27(3):218-228. [doi: 10.1016/j.soncn.2011.04.007] [Medline: 21783013]
86. Dorr D, Bonner LM, Cohen AN, Shoai RS, Perrin R, Chaney E, et al. Informatics systems to promote improved care for chronic illness: A literature review. J Am Med Inform Assoc 2007;14(2):156-163 [FREE Full text] [doi: 10.1197/jamia.M2255] [Medline: 17213491]
87. Sunyaev A. Evaluation of Microsoft HealthVault and Google Health personal health records. Health Technol 2013 Feb 24;3(1):3-10. [doi: 10.1007/s12553-013-0049-4]
88. Sunyaev A, Chornyi D. Supporting chronic disease care quality. J. Data and Information Quality 2012 May 01;3(2):1-21. [doi: 10.1145/2184442.2184443]
89. Hufnagel SP. Interoperability. Mil Med 2009 May;174(5 Suppl):43-50. [Medline: 19562961]
90. Spiekermann S. The challenges of privacy by design. Commun. ACM 2012 Jul 01;55(7):38-40. [doi: 10.1145/2209249.2209263]
91. Klasnja P, Consolvo S, Choudhury T, Beckwith R, Hightower J. Exploring privacy concerns about personal sensing. Berlin, Germany: Springer; 2009 Presented at: Int Conf Pervasive Comput; May 11-14, 2009; Nara, Japan p. 176-183. [doi: 10.1007/978-3-642-01516-8_13]
92. Seneviratne S, Seneviratne A, Mohapatra P, Mahanti A. Predicting user traits from a snapshot of apps installed on a smartphone. SIGMOBILE Mob. Comput. Commun. Rev 2014 Jun 03;18(2):1-8. [doi: 10.1145/2636242.2636244]
93. Wilson DW, Valacich JS. Unpacking the privacy paradox: Irrational decision-making within the privacy calculus.: Irrational Decision-Making within the Privacy Calculus. Proc Thirty Third Int Conf Inf Syst ICIS 2012 Orlando, FL, U. S; 2012 Presented at: Int Conf Inf Sys; December 16-19, 2012; Orlando, FL, USA URL: http://aisel.aisnet.org/cgi/viewcontent.cgi?article=1286&context=icis2012
94. Sunyaev A, Dehling T, Taylor PL, Mandl KD. Availability and quality of mobile health app privacy policies. J Am Med Inform Assoc 2014 Aug 21. [doi: 10.1136/amiajnl-2013-002605] [Medline: 25147247]
95. Sunyaev A, Schneider S. Cloud services certification. Commun. ACM 2013 Feb 01;56(2):33-36. [doi: 10.1145/2408776.2408789]