Assessment of the Fairness of Privacy Policies of Mobile Health Apps: Scale Development and Evaluation in Cancer Apps

Promoting the social implementation of digital and mobile health: effects of regulation on user and non-user behavior in East Asia

This study conducted policy and regulation analyses and user acceptance surveys in three East Asian countries with developed telecommunication infrastructure (China, South Korea, and Japan) to determine the most effective way to implement mobile health (mHealth). Regional differences in users' emphasis on the purpose of mHealth, including medical information referral or health management, appear to be influenced by regional regulation, thus making regulation analysis important when considering mHealth penetration strategies. Potential mHealth users have high expectations for medical information and correspondence, which is crucial for the pharmaceutical industry in terms of providing information and retaining patients. Furthermore, potential users are willing to use the system medically, which is beneficial to the pharmaceutical industry when introducing mHealth and prescriptions in combination.

A Proposal for a Robust Validated Weighted General Data Protection Regulation-Based Scale to Assess the Quality of Privacy Policies of Mobile Health Applications: An eDelphi Study

BACKGROUND

Health care services are undergoing a digital transformation in which the Participatory Health Informatics field has a key role. Within this field, studies aimed to assess the quality of digital tools, including mHealth apps, are conducted. Privacy is one dimension of the quality of an mHealth app. Privacy consists of several components, including organizational, technical, and legal safeguards. Within legal safeguards, giving transparent information to the users on how their data are handled is crucial. This information is usually disclosed to users through the privacy policy document. Assessing the quality of a privacy policy is a complex task and several scales supporting this process have been proposed in the literature. However, these scales are heterogeneous and even not very objective. In our previous study, we proposed a checklist of items guiding the assessment of the quality of an mHealth app privacy policy, based on the General Data Protection Regulation.

OBJECTIVE

To refine the robustness of our General Data Protection Regulation-based privacy scale to assess the quality of an mHealth app privacy policy, to identify new items, and to assign weights for every item in the scale.

METHODS

A two-round modified eDelphi study was conducted involving a privacy expert panel.

RESULTS

After the Delphi process, all the items in the scale were considered "important" or "very important" (4 and 5 in a 5-point Likert scale, respectively) by most of the experts. One of the original items was suggested to be reworded, while eight tentative items were suggested. Only two of them were finally added after Round 2. Eleven of the 16 items in the scale were considered "very important" (weight of 1), while the other 5 were considered "important" (weight of 0.5).

CONCLUSION

The Benjumea privacy scale is a new robust tool to assess the quality of an mHealth app privacy policy, providing a deeper and complementary analysis to other scales. Also, this robust scale provides a guideline for the development of high-quality privacy policies of mHealth apps.

Critical Criteria and Countermeasures for Mobile Health Developers to Ensure Mobile Health Privacy and Security: Mixed Methods Study

BACKGROUND

Despite the importance of the privacy and confidentiality of patients' information, mobile health (mHealth) apps can raise the risk of violating users' privacy and confidentiality. Research has shown that many apps provide an insecure infrastructure and that security is not a priority for developers.

OBJECTIVE

This study aims to develop and validate a comprehensive tool to be considered by developers for assessing the security and privacy of mHealth apps.

METHODS

A literature search was performed to identify papers on app development, and those papers reporting criteria for the security and privacy of mHealth were assessed. The criteria were extracted using content analysis and presented to experts. An expert panel was held for determining the categories and subcategories of the criteria according to meaning, repetition, and overlap; impact scores were also measured. Quantitative and qualitative methods were used for validating the criteria. The validity and reliability of the instrument were calculated to present an assessment instrument.

RESULTS

The search strategy identified 8190 papers, of which 33 (0.4%) were deemed eligible. A total of 218 criteria were extracted based on the literature search; of these, 119 (54.6%) criteria were removed as duplicates and 10 (4.6%) were deemed irrelevant to the security or privacy of mHealth apps. The remaining 89 (40.8%) criteria were presented to the expert panel. After calculating impact scores, the content validity ratio (CVR), and the content validity index (CVI), 63 (70.8%) criteria were confirmed. The mean CVR and CVI of the instrument were 0.72 and 0.86, respectively. The criteria were grouped into 8 categories: authentication and authorization, access management, security, data storage, integrity, encryption and decryption, privacy, and privacy policy content.

CONCLUSIONS

The proposed comprehensive criteria can be used as a guide for app designers, developers, and even researchers. The criteria and the countermeasures presented in this study can be considered to improve the privacy and security of mHealth apps before releasing the apps into the market. Regulators are recommended to consider an established standard using such criteria for the accreditation process, since the available self-certification of developers is not reliable enough.

A systematic review of m-health apps on managing side effects of breast cancer treatment

PURPOSE

After breast cancer treatment, women with breast cancer may experience distress caused by treatment side effects, both in physical and psychological aspects. Technology use is increasing in favor among women. Therefore, it is essential to update the scientific evidence regarding mobile and web apps' effectiveness in managing the side effects of breast cancer treatments for breast cancer survivors. The purpose of this systematic review was to investigate the scientific evidence on the effectiveness of mobile and web apps in managing the side effects of breast cancer treatments among this group.

METHODS

A literature search was conducted using ScienceDirect, Scopus, PubMed, CINAHL, and Cochrane. Published papers in English focused on mobile and web apps and the side effects of breast cancer treatment in breast cancer survivors were selected. The search reviewed studies from January 2011 to December 2021. From a total of 925 retrieved manuscripts, 11 studies were included for analysis.

RESULTS

The findings showed that mobile apps were more frequently used and more likely to be an effective method for managing the side effects of breast cancer treatment among breast cancer survivors. The content in web or mobile apps for breast cancer survivors should include five categories: (1) information about cancer, (2) overview of cancer care, (3) opportunities for interaction with other people, (4) symptom management strategies, and (5) feedback about cancer treatment side effect management. However, a few studies examined the effects of a combination of mobile and web apps in managing breast cancer treatment side effects. Therefore, future research is needed to examine solo and combination use. In addition, more rigorous studies are warranted to examine these interventions.

CONCLUSIONS

Nurses may refer survivors to these resources to obtain more information and effectively manage the signs and symptoms of breast cancer and its treatment side effects.

Recruitment and retention in mobile application-based intervention studies: a critical synopsis of challenges and opportunities

Use of mobile health applications (mHealth apps) is becoming increasingly popular for the management of chronic illnesses, but mHealth-based intervention studies often have limitations associated with subject recruitment and retention. In this synopsis, we focus on targeted aspects of mHealth-based intervention studies, specifically: (i) subject recruitment, (ii) cohort sizes, and (iii) retention rates. We used the Google Scholar (meta-search) and Galileo search engines to identify sample articles focusing on mHealth apps and interventions published between 2010 and 2020 and selected 21 papers for detailed review. Most studies recruited relatively small cohorts (minimum: 20, maximum: 510). Retention rates had high variance with only five studies managing >80% subject retention throughout the study duration, 10.4% being the lowest. Eighty-five percent of the studies expressed concerns regarding study duration, app usage, and lack of proper implementation. The use of mHealth interventions generally yielded positive outcomes, but most studies discussed facing challenges associated with recruitment and retention. There is a clear need to identify strategies for recruiting larger cohorts and improving retention rates, and ultimately increasing the reliability of mHealth app-based intervention studies. We advise that potential underutilized opportunities lie at the intersection of mHealth and social media to address the limitations identified in the synopsis.

Pulse Oximeter App Privacy Policies During COVID-19: Scoping Assessment

Background

Pulse oximeter apps became of interest to consumers during the COVID-19 pandemic, particularly when traditional over-the-counter pulse oximeter devices were in short supply. Yet, no study to date has examined or scoped the state of privacy policies and notices for the top-rated and most downloaded pulse oximeter apps during COVID-19.

Objective

The aim of this study was to examine, through a high-level qualitative assessment, the state and nature of privacy policies for the downloaded and top-rated pulse oximeter apps during the COVID-19 pandemic to (1) compare findings against comparable research involving other mobile health (mHealth) apps and (2) begin discussions on opportunities for future research or investigation.

Methods

During August-October 2020, privacy policies were reviewed for pulse oximeter apps that had either at least 500 downloads (Google Play Store apps only) or a three out of five-star rating (Apple Store apps only). In addition to determining if the apps had an accessible privacy policy, other key privacy policy–related details that were extracted included, but were not limited to, app developer location (country); whether the app was free or required paid use/subscription; whether an ads disclosure was provided on the app’s site; the scope of personal data collected; proportionality, fundamental rights, and data protection and privacy issues; and privacy safeguards.

Results

Six pulse oximeter apps met the inclusion criteria and only 33% (n=2) of the six apps had an accessible privacy policy that was specific to the pulse oximeter app feature (vs the app developer’s website or at all). Variation was found in both the regulatory nature and data privacy protections offered by pulse oximeter apps, with notable privacy protection limitations and gaps, although each app provided at least some information about the scope of personal data collected upon installing the app.

Conclusions

Pulse oximeter app developers should invest in offering stronger privacy protections for their app users, and should provide more accessible and transparent privacy policies. This is a necessary first step to ensure that the data privacy of mHealth consumers is not exploited during public health emergency situations such as the COVID-19 pandemic, where over-the-counter personal health monitoring devices could be in short supply and patients and consumers may, as a result, turn to mHealth apps to fill such supply gaps. Future research considerations and recommendations are also suggested for mHealth technology and privacy researchers who are interested in examining privacy implications associated with the use of pulse oximeter apps during and after the COVID-19 pandemic.

A Review of the Quality and Impact of Mobile Health Apps

Mobile health applications (apps) have transformed the possibilities for health promotion and disease self-management; however, their promise is not fully realized owing to their reliance on commercial ecosystems for development and distribution. This review provides an overview of the types of mobile health apps and describes key stakeholders in terms of how apps are used, developed, and regulated. I outline key challenges facing consumers, public health professionals, and policy makers in evaluating the quality of health apps and summarize what is known about the impact of apps on health outcomes and health equity. I suggest that factors within the wider mobile ecosystem largely define the impact of health apps and, most notably, practices around the collection and commercialization of user data. Finally, I suggest that upstream public health strategies, grounded in an understanding of corporate influences on health, are necessary to promote healthy digital environments in which mobile health app innovation can flourish. Expected final online publication date for the Annual Review of Public Health, Volume 43 is April 2022. Please see http://www.annualreviews.org/page/journal/pubdates for revised estimates.

Post-COVID Public Health Surveillance and Privacy Expectations in the United States: Scenario-Based Interview Study

BACKGROUND

Smartphone-based apps designed and deployed to mitigate the COVID-19 pandemic may become infrastructure for postpandemic public health surveillance in the United States. Through the lenses of privacy concerns and user expectations of digital pandemic mitigation techniques, we identified possible long-term sociotechnical implications of such an infrastructure.

OBJECTIVE

We explored how people in the United States perceive the possible routinization of pandemic tracking apps for public health surveillance in general. Our interdisciplinary analysis focused on the interplay between privacy concerns, data practices of surveillance capitalism, and trust in health care providers. We conducted this analysis to achieve a richer understanding of the sociotechnical issues raised by the deployment and use of technology for pandemic mitigation.

METHODS

We conducted scenario-based, semistructured interviews (n=19) with adults in the United States. The interviews focused on how people perceive the short- and long-term privacy concerns associated with a fictional smart thermometer app deployed to mitigate the "outbreak of a contagious disease." In order to elicit future-oriented discussions, the scenario indicated that the app would continue functioning "after the disease outbreak has dissipated." We analyzed interview transcripts using reflexive thematic analysis.

RESULTS

In the context of pandemic mitigation technology, including app-based tracking, people perceive a core trade-off between public health and personal privacy. People tend to rationalize this trade-off by invoking the concept of "the greater good." The interplay between the trade-off and rationalization forms the core of sociotechnical issues that pandemic mitigation technologies raise. Participants routinely expected that data collected through apps related to public health would be shared with unknown third parties for the financial gain of the app makers. This expectation suggests a perceived alignment between an app-based infrastructure for public health surveillance and the broader economics of surveillance capitalism. Our results highlight unintended and unexpected sociotechnical impacts of routinizing app-based tracking on postpandemic life, which are rationalized by invoking a nebulous concept of the greater good.

CONCLUSIONS

While technologies such as app-based tracking could be useful for pandemic mitigation and preparedness, the routinization of such apps as a form of public health surveillance may have broader, unintentional sociotechnical implications for individuals and the societies in which they live. Although technology has the potential to increase the efficacy of pandemic mitigation, it exists within a broader network of sociotechnical concerns. Therefore, it is necessary to consider the long-term implications of pandemic mitigation technologies beyond the immediate needs of addressing the COVID-19 pandemic. Potential negative consequences include the erosion of patient trust in health care systems and providers, grounded in concerns about privacy violations and overly broad surveillance.

Examining Protection Motivation and Network Externality Perspective Regarding the Continued Intention to Use M-Health Apps

M-health apps have developed rapidly and are widely accepted, but users' continued intention to use m-health apps has not been fully explored. This study was designed to obtain a better understanding of users' continued intention to use m-health apps. We developed a theoretical model by incorporating the protection motivation theory and network externalities and conducted an empirical study of a 368-respondent sample. The results showed that: (1) perceived vulnerability has a direct impact on users' self-efficacy and response efficacy; (2) self-efficacy and response efficacy have a direct impact on users' attitudes and continued intention; (3) network externalities affect users' attitudes and continued intention, among which direct network externalities have an indirect impact on users' continued intention through attitude; and (4) the impacts of self-efficacy, response efficacy, and indirect network externalities on continued intention are partially meditated by attitudes.

Privacy Policy Compliance of Chronic Disease Management Apps in China: Scale Development and Content Evaluation

Background

With the development of mobile health (mHealth), chronic disease management apps have brought not only the possibility of reducing the burden of chronic diseases but also huge privacy risks to patients’ health data.

Objective

The purpose of the study was to analyze the extent to which chronic disease management apps in China comply with the Personal Information Security Specification (PI Specification).

Methods

The compliance of 45 popular chronic disease management apps was evaluated from the perspective of the information life cycle. To conduct a fine-grained evaluation, a scale based on the PI Specification was developed. Finally, 6 level 1 indicators, 22 level 2 indicators, and 61 level 3 indicators were defined.

Results

There were 33/45 apps (73%) with a privacy policy, and the average score of these apps was 40.4 out of 100. Items of level 1 indicators with high scores included general characteristics (mean 51.9% [SD 28.1%]), information collection and use (mean 51.1% [SD 36.7%]), and information sharing and transfer (mean 50.3% [SD 33.5%]). Information storage and protection had the lowest compliance with PI Specification (mean 29.4% [SD 32.4%]). Few personal information (PI) controllers have stated how to handle security incidents, including security incident reporting (7/33, 21%), security incident notification (10/33, 30%), and commitment to bear corresponding legal responsibility for PI security incidents (1/33, 3%). The performance of apps in the stage of information destruction (mean 31.8% [SD 40.0%]) was poor, and only 21% (7/33) apps would notify third parties to promptly delete PI after individuals cancelled their accounts. Moreover, the scoring rate for rights of PI subjects is generally low (mean 31.2% [SD 35.5%]), especially for obtaining copies of PI (15%) and responding to requests (25%).

Conclusions

Although most chronic disease management apps had a privacy policy, the total compliance rate of the policy content was low, especially in the stage of information storage and protection. Thus, the field has a long way to go with regard to compliance around personal privacy protection in China.

Analysis of Diabetes Apps to Assess Privacy-Related Permissions: Systematic Search of Apps

Background

Mobile health has become a major vehicle of support for people living with diabetes. Accordingly, the availability of mobile apps for diabetes has been steadily increasing. Most of the previous reviews of diabetes apps have focused on the apps’ features and their alignment with clinical guidelines. However, there is a lack of knowledge on the actual compliance of diabetes apps with privacy and data security guidelines.

Objective

The aim of this study was to assess the levels of privacy of mobile apps for diabetes to contribute to the raising of awareness of privacy issues for app users, developers, and governmental data protection regulators.

Methods

We developed a semiautomatic app search module capable of retrieving Android apps’ privacy-related information, particularly the dangerous permissions required by apps, with the aim of analyzing privacy aspects related to diabetes apps. Following the research selection criteria, the original 882 apps were narrowed down to 497 apps that were included in the analysis.

Results

Approximately 60% of the analyzed diabetes apps requested potentially dangerous permissions, which pose a significant risk to users’ data privacy. In addition, 28.4% (141/497) of the apps did not provide a website for their privacy policy. Moreover, it was found that 40.0% (199/497) of the apps contained advertising, and some apps that claimed not to contain advertisements actually did. Ninety-five percent of the apps were free, and those belonging to the “medical” and “health and fitness” categories were the most popular. However, app users do not always realize that the free apps’ business model is largely based on advertising and, consequently, on sharing or selling their private data, either directly or indirectly, to unknown third parties.

Conclusions

The aforementioned findings confirm the necessity of educating patients and health care providers and raising their awareness regarding the privacy aspects of diabetes apps. Therefore, this research recommends properly and comprehensively training users, ensuring that governments and regulatory bodies enforce strict data protection laws, devising much tougher security policies and protocols in Android and in the Google Play Store, and implicating and supervising all stakeholders in the apps’ development process.

Understanding the evaluation of mHealth app features based on a cross-country Kano analysis

While mobile health (mHealth) apps play an increasingly important role in digitalized health care, little is known regarding the effects of specific mHealth app features on user satisfaction across different healthcare system contexts. Using personal health record (PHR) apps as an example, this study identifies how potential users in Germany and Denmark evaluate a set of 26 app features, and whether evaluation differences can be explained by the differences in four pertinent user characteristics, namely privacy concerns, mHealth literacy, mHealth self-efficacy, and adult playfulness. Based on survey data from both countries, we employed the Kano method to evaluate PHR features and applied a quartile-based sample-split approach to understand the underlying relationships between user characteristics and their perceptions of features. Our results not only reveal significant differences in 14 of the features between Germans and Danes, they also demonstrate which of the user characteristics best explain each of these differences. Our two key contributions are, first, to explain the evaluation of specific PHR app features on user satisfaction in two different healthcare contexts and, second, to demonstrate how to extend the Kano method in terms of explaining subgroup differences through user characteristic antecedents. The implications for app providers and policymakers are discussed.