Unaddressed privacy risks in accredited health and wellness apps: a cross-sectional systematic assessment
By K. Huckvale, José Tomás Prieto, M. Tilney, Pierre Benghozi, Josip Car. BMC Medicine, 2015
366 citations recorded by the source corpus.
BackgroundPoor information privacy practices have been identified in health apps. Medical app accreditation programs offer a mechanism for assuring the quality of apps; however, little is known about their ability to control information privacy risks. We aimed to assess the extent to which already-certified apps complied with data protection principles mandated by the largest national accreditation program.MethodsCross-sectional, systematic, 6-month assessment of 79 apps certified as clinically safe and trustworthy by the UK NHS Health Apps Library. Protocol-based testing was used to characterize personal information collection, local-device storage and information transmission. Observed information handling practices were compared against privacy policy commitments.ResultsThe study revealed that 89 % (n = 70/79) of apps transmitted information to online services. No app encrypted personal information stored locally. Furthermore, 66 % (23/35) of apps sending identifying information over the Internet did not use encryption and 20 % (7/35) did not have a privacy policy. Overall, 67 % (53/79) of apps had some form of privacy policy. No app collected or transmitted information that a policy explicitly stated it would not; however, 78 % (38/49) of information-transmitting apps with a policy did not describe the nature of personal information included in transmissions. Four apps sent both identifying and health information without encryption. Although the study was not designed to examine data handling after transmission to online services, security problems appeared to place users at risk of data theft in two cases.ConclusionsSystematic gaps in compliance with data protection principles in accredited health apps question whether certification programs relying substantially on developer disclosures can provide a trusted resource for patients and clinicians. Accreditation programs should, as a minimum, provide consistent and reliable warnings about possible threats and, ideally, require publishers to rectify vulnerabilities before apps are released.
Subfields: Applied Psychology, General Health Professions, Health Information Management
View Paper: https://www.semanticscholar.org/paper/02749722c8bdfec410ef318feebd27c14cdd5e23
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Applied Psychology
In General Health Professions
Citations in the corpus
- Threats and thrills: pregnancy apps, risk and consumption (2016, background): “exploitation by app developers and third parties to whom they sell these data (Huckvale et al., 2015; Ackerman, 2013), including pregnancy apps (Dembosky, 2013; Scott et al.”
- Understanding factors affecting patient and public engagement and recruitment to digital health interventions: a systematic review of qualitative studies (2016, neutral): “More research on whether DHIs should be accredited and approved by healthcare organisations and clinicians and how this should be done, given legal and ethical implications, would also be useful to provide guidance to individual healthcare professionals as well as local and national health services ”
- Evaluating digital health interventions: key questions and approaches (2016, neutral): “A SMART is a special case of the factorial experiment involving randomization at several stages, where each stage corresponds to one of the decisions that must be made about adapting the intervention, and some or all of the randomization may be contingent on response to treatment.(35,47) System iden”