A new warning has been sounded about the security of health apps and the way that data is handled. This comes from a report in the British Medical Journal, based on a study undertaken by Australian academics.
The study from Macquarie University finds that the developers of many mobile health apps are failing to safeguard the privacy of users. This was not a small sample study, reports The Guardian. The researchers looked at 15,000 free mobile health (generally referred to as mHealth) apps. Each of the applications was found on the Google Play store.
The researchers not only looked at the privacy features for the health apps, they also cross-compared the protocols and data usage with 8,000 non-health apps. Both across the health apps and in comparison with the non-health apps, the outcome was not good, leading the researchers to point to “serious problems with privacy and inconsistent privacy practices.”
It also stands that many of the inspected apps are popular ones and of the type whereby users may seek to draw important health conclusions. The types of apps examined included those used to assess serious health conditions; to examined for different symptom in order to self-diagnose; fitness motivational tools and calorie counters; menstruation trackers, and so on. Much of the data collected would be classed as sensitive health information under any reasonable measure.
Not only were many of the apps collecting personal data and storing it, there were concerns about repackaging and selling these data. It was also apparent that many users were unaware as to what was happening to their data. This led to the researchers concluding in their study that users: “should be informed on the privacy practices of these apps and the associated privacy risks before installation and use.”
In particular, their were insufficient options for users to permit the app to share data. Not only was this practice not transparent, it was also widespread. The study found that 88 percent of mobile health apps contained a code that could, potentially at least, collect user data.
Moreover, around 4 percent of the apps were found to be actively transmitting information. Where data was collected, 56 percent of user data transmissions were on behalf of third party services. It is quite likely that users were unaware of the extent of their medical data is being passed on to another company. Such third party services included external advertisers and companies that provide tracking services. Often different apps were using the same third party service providers.
In fact, just 50 third parties were responsible two-thirds of the data collection operations. Included among these were companies that value data greatly, such as Google, Facebook, and Yahoo!.
The types of data captured included: Advert identifiers, cookies, user email addresses, mobile phone tower locations (for geolocation purposes).
It would appear that a new standard, enforced by regulation, is required to protect users of health apps.
