Information handling by some health apps not as secure as it should be
Medical Xpress | 25 September 2015
Some health apps that have been clinically-accredited may not have been complying with principles of data protection, according to research published in the open access journal BMC Medicine. In some instances health apps were found to be sending unencrypted personal and health information, which means users of these apps may have had their privacy put at risk.
Abstract : As a way of reassuring users about the quality and safety of health apps, several app accreditation programs have been launched. One such program is the UK’s NHS Health Apps Library, which is a curated list of apps for patient and public use. Registered apps undergo an appraisal process that examines clinical safety and compliance with data protection law. To be listed in the Health Apps Library, developers are required to declare any data transmissions and register with the UK’s Information Commissioner’s Office – the body that enforces the Data Protection Act.
The researchers from Imperial College London, UK, and Ecole Polytechnique CNRS, France, reviewed 79 apps that were listed on the UK NHS Health Apps Library in July 2013 and are available on Android and iOS platforms. The apps covered health areas such as weight loss, alcohol harm reduction, smoking cessation and long-term condition self-care.
The apps were assessed over a six-month period by inputting simulated information, tracking the handling of this information, and looking at how this agreed with any associated privacy policies. Of the apps reviewed, it was found that 70 of the apps transmitted information to online services and 23 of those sent identifying information over the internet without encryption. Of the 38 apps that had a privacy policy and transmitted information, the privacy policy did not state what personal information would be included in the transmissions. Four apps were found to be sending both identifying and health information without encryption.
