Dataset Information

Server-Focused Security Assessment of Mobile Health Apps for Popular Mobile Platforms.

ABSTRACT:

Background

The importance of mobile health (mHealth) apps is growing. Independent of the technologies used, mHealth apps bring more functionality into the hands of users. In the health context, mHealth apps play an important role in providing information and services to patients, offering health care professionals ways to monitor vital parameters or consult patients remotely. The importance of confidentiality in health care and the opaqueness of transport security in apps make the latter an important research subject.

Objective

This study aimed to (1) identify relevant security concerns on the server side of mHealth apps, (2) test a subset of mHealth apps regarding their vulnerability to those concerns, and (3) compare the servers used by mHealth apps with servers used in all domains.

Methods

Server security characteristics relevant to the security of mHealth apps were assessed, presented, and discussed. To evaluate servers, appropriate tools were selected. Apps from the Android and iOS app stores were selected and tested, and the results for functional and other backend servers were evaluated.

Results

The 60 apps tested communicate with 823 servers. Of these, 291 were categorized as functional backend servers, and 44 (44/291, 15.1%) of these received a rating below the A range (A+, A, and A-) by Qualys SSL Labs. A chi-square test was conducted against the number of servers receiving such ratings from SSL Pulse by Qualys SSL Labs. It was found that the tested servers from mHealth apps received significantly fewer ratings below the A range (P<.001). The internationally available apps from the test set performed significantly better than those only available in the German stores (alpha=.05; P=.03). Of the 60 apps, 28 (28/60, 47%) were found using at least one functional backend server that received a rating below the A range from Qualys SSL Labs, endangering confidentiality, authenticity, and integrity of the data displayed. The number of apps that used at least one entirely unsecured connection was 20 (20/60, 33%) when communicating with functional backend servers. It was also found that a majority of apps used advertising, tracking, or external content provider servers. When looking at all nonfunctional backend servers, 48 (48/60, 80%) apps used at least one server that received a rating below the A range.

Conclusions

The results show that although servers in the mHealth domain perform significantly better regarding their security, there are still problems with the configuration of some. The most severe problems observed can expose patient communication with health care professionals, be exploited to display false or harmful information, or used to send data to an app facilitating further damage on the device. Following the recommendations for mHealth app developers, the most regularly observed security issues can be avoided or mitigated.

SUBMITTER: Muthing J

PROVIDER: S-EPMC6364205 | biostudies-literature | 2019 Jan

REPOSITORIES: biostudies-literature

ACCESS DATA

Publications

Server-Focused Security Assessment of Mobile Health Apps for Popular Mobile Platforms.

Müthing Jannis J Brüngel Raphael R Friedrich Christoph M CM

Journal of medical Internet research 20190123 1

<h4>Background</h4>The importance of mobile health (mHealth) apps is growing. Independent of the technologies used, mHealth apps bring more functionality into the hands of users. In the health context, mHealth apps play an important role in providing information and services to patients, offering health care professionals ways to monitor vital parameters or consult patients remotely. The importance of confidentiality in health care and the opaqueness of transport security in apps make the latter ...[more]

PMID: 30672738

Similar Datasets

Project description:BackgroundModern families are facing conflicting demands on their time and resources, which may be at the detriment of child and family diet quality. Innovative nutrition interventions providing parents with behavioral support for the provision of healthy food could alleviate this issue. Mobile apps have the potential to deliver such interventions by providing practical behavioral support remotely, interactively, and in context.ObjectiveThis review aimed to identify and assess popular, commercially available food- and nutrition-related mobile apps that offer support for the provision of healthy family food by (1) describing app scope and characteristics, (2) assessing app quality, and (3) conducting a behavioral analysis of app content and features.MethodsSearches in the Google Play Store and Apple App Store between August 2017 and November 2017 identified apps addressing the food provision process. Apps were included if they were applicable to parents or families, written in English, and with a user rating of ?4 stars. Weight loss and diet monitoring apps and subscription apps with no free versions were excluded. App quality was assessed using the Mobile App Rating Scale (4 domains: engagement, functionality, aesthetics, and information). App content and features were extracted and behavior change techniques (BCTs) identified.ResultsOf the 2881 apps screened, 1.77% (51/2881) were included for assessment, comprising 23 recipe and recipe manager apps, 12 meal planning apps, 10 shopping list apps, 4 family organizers, and 2 food choice apps. Half (n=26) of the apps functioned primarily through user data input. Food choice and family organizer apps scored highest for app quality (mean 3.5 [SD 0.6] out of 5), whereas most apps scored well for functionality and poorly for engagement. Common app features with the potential to support healthy food provision included meal planners (n=26), shopping lists (n=44), and the ability to share app content (n=48). Behavioral support features mapped to relatively few BCTs (mean 3.9 [SD 1.9] per app), with Adding objects to the environment present in all apps, and 65% (33/51) including Instruction on how to perform the behavior.ConclusionsRecipe and recipe manager apps, meal planning apps, and family organizers with integrated meal planning and shopping lists scored well for functionality and incorporated behavioral support features that could be used to address barriers to healthy food provision, although features were focused on planning behaviors. Future apps should combine a range of features such as meal planners, shopping lists, simple recipes, reminders and prompts, and food ordering to reduce the burden of the food provision pathway and incorporate a range of BCTs to maximize behavior change potential. Researchers and developers should consider features and content that improve the engagement quality of such apps.

Project description:BACKGROUND:Nutrition-related apps are commonly used to provide information about the user's dietary intake, but limited research has been performed to assess how well their outputs agree with those from standard methods. OBJECTIVE:The objective of our study was to evaluate the level of agreement of popular nutrition-related apps for the assessment of energy and available macronutrients and micronutrients against a UK reference method. METHODS:We compared dietary analysis of 24-hour weighed food records (n=20) between 5 nutrition-related apps (Samsung Health, MyFitnessPal, FatSecret, Noom Coach, and Lose It!) and Dietplan6 (reference method), using app versions available in the United Kingdom. We compared estimates of energy, macronutrients (carbohydrate, protein, fat, saturated fat, and fiber), and micronutrients (sodium, calcium, iron, vitamin A, and vitamin C) using paired t tests and Wilcoxon signed-rank tests, correlation coefficients, and Bland-Altman plots. We obtained 24-hour weighed food records from 20 participants (15 female, 5 male participants; mean age 36.3 years; mean body mass index 22.9 kg/m2) from previous controlled studies conducted at the Hugh Sinclair Unit of Human Nutrition, University of Reading, Reading, UK. Participants had recorded their food consumption over a 24-hour period using standard protocols. RESULTS:The difference in estimation of energy and saturated fat intake between Dietplan6 and the diet apps was not significant. Estimates of protein and sodium intake were significantly lower using Lose It! and FatSecret than using Dietplan6. Lose It! also gave significantly lower estimates for other reported outputs (carbohydrate, fat, fiber, and sodium) than did Dietplan6. Samsung Health and MyFitnessPal significantly underestimated calcium, iron, and vitamin C compared with Dietplan6, although there was no significant difference for vitamin A. We observed no other significant differences between Dietplan6 and the apps. Correlation coefficients ranged from r=-.12 for iron (Samsung Health vs Dietplan6) to r=.91 for protein (FatSecret vs Dietplan6). Noom Coach was limited to energy output, but it had a high correlation with Dietplan6 (r=.91). Samsung Health had the greatest variation of correlation, with energy at r=.79. Bland-Altman analysis revealed potential proportional bias for vitamin A. CONCLUSIONS:The findings suggest that the apps provide estimates of energy and saturated fat intake comparable with estimates by Dietplan6. With the exception of Lose It!, the apps also provided comparable estimates of carbohydrate, total fat, and fiber. FatSecret and Lose It! tended to underestimate protein and sodium. Estimates of micronutrient intake (calcium, iron, vitamin A, and vitamin C) by 2 apps (Samsung Health and MyFitnessPal) were inconsistent and less reliable. Lose It! was the app least comparable with Dietplan6. As the use and availability of apps grows, this study helps clinicians and researchers to make better-informed decisions about using these apps in research and practice.

Project description:BackgroundMobile health (mHealth) apps show a growing importance for patients and health care professionals. Apps in this category are diverse. Some display important information (ie, drug interactions), whereas others help patients to keep track of their health. However, insufficient transport security can lead to confidentiality issues for patients and medical professionals, as well as safety issues regarding data integrity. mHealth apps should therefore deploy intensified vigilance to protect their data and integrity. This paper analyzes the state of security in mHealth apps.ObjectiveThe objectives of this study were as follows: (1) identification of relevant transport issues in mHealth apps, (2) development of a platform for test purposes, and (3) recommendation of practices to mitigate them.MethodsSecurity characteristics relevant to the transport security of mHealth apps were assessed, presented, and discussed. These characteristics were used in the development of a prototypical platform facilitating streamlined tests of apps. For the tests, six lists of the 10 most downloaded free apps from three countries and two stores were selected. As some apps were part of these top 10 lists in more than one country, 53 unique apps were tested.ResultsOut of the 53 apps tested from three European App Stores for Android and iOS, 21/53 (40%) showed critical results. All 21 apps failed to guarantee the integrity of data displayed. A total of 18 apps leaked private data or were observable in a way that compromised confidentiality between apps and their servers; 17 apps used unprotected connections; and two apps failed to validate certificates correctly. None of the apps tested utilized certificate pinning. Many apps employed analytics or ad providers, undermining user privacy.ConclusionsThe tests show that many mHealth apps do not apply sufficient transport security measures. The most common security issue was the use of any kind of unprotected connection. Some apps used secure connections only for selected tasks, leaving all other traffic vulnerable.

Project description:BackgroundPrivacy has always been a concern, especially in the health domain. The proliferation of mobile health (mHealth) apps has led to a large amount of sensitive data being generated. Some authors have performed privacy assessments of mHealth apps. They have evaluated diverse privacy components; however, different authors have used different criteria for their assessments.ObjectiveThis scoping review aims to understand how privacy is assessed for mHealth apps, focusing on the components, scales, criteria, and scoring methods used. A simple taxonomy to categorize the privacy assessments of mHealth apps based on component evaluation is also proposed.MethodsWe followed the methodology defined by Arksey and O'Malley to conduct a scoping review. Included studies were categorized based on the privacy component, which was assessed using the proposed taxonomy.ResultsThe database searches retrieved a total of 710 citations-24 of them met the defined selection criteria, and data were extracted from them. Even though the inclusion criteria considered articles published since 2009, all the studies that were ultimately included were published from 2014 onward. Although 12 papers out of 24 (50%) analyzed only privacy, 8 (33%) analyzed both privacy and security. Moreover, 4 papers (17%) analyzed full apps, with privacy being just part of the assessment. The evaluation criteria used by authors were heterogeneous and were based on their experience, the literature, and/or existing legal frameworks. Regarding the set of items used for the assessments, each article defined a different one. Items included app permissions, analysis of the destination, analysis of the content of communications, study of the privacy policy, use of remote storage, and existence of a password to access the app, among many others. Most of the included studies provided a scoring method that enables the comparison of privacy among apps.ConclusionsThe privacy assessment of mHealth apps is a complex task, as the criteria used by different authors for their evaluations are very heterogeneous. Although some studies about privacy assessment have been conducted, a very large set of items to evaluate privacy has been used up until now. In-app information and privacy policies are primarily utilized by the scientific community to extract privacy information from mHealth apps. The creation of a scale based on more objective criteria is a desirable step forward for privacy assessment in the future.

Project description:BackgroundThe number of mobile health apps is rapidly increasing. This means that consumers are faced with a bewildering array of choices, and finding the benefit of such apps may be challenging. The significant international burden of breast cancer (BC) and the potential of mobile health apps to improve medical and public health practices mean that such apps will likely be important because of their functionalities in daily life. As the app market has grown exponentially, several review studies have scrutinized cancer- or BC-related apps. However, those reviews concentrated on the availability of the apps and relied on user ratings to decide on app quality. To minimize subjectivity in quality assessment, quantitative methods to assess BC-related apps are required.ObjectiveThe purpose of this study is to analyze the content and quality of BC-related apps to provide useful information for end users and clinicians.MethodsBased on a stepwise systematic approach, we analyzed apps related to BC, including those related to prevention, detection, treatment, and survivor support. We used the keywords "breast cancer" in English and Korean to identify commercially available apps in the Google Play and App Store. The apps were then independently evaluated by 2 investigators to determine their eligibility for inclusion. The content and quality of the apps were analyzed using objective frameworks and the Mobile App Rating Scale (MARS), respectively.ResultsThe initial search identified 1148 apps, 69 (6%) of which were included. Most BC-related apps provided information, and some recorded patient-generated health data, provided psychological support, and assisted with medication management. The Kendall coefficient of concordance between the raters was 0.91 (P<.001). The mean MARS score (range: 1-5) of the apps was 3.31 (SD 0.67; range: 1.94-4.53). Among the 5 individual dimensions, functionality had the highest mean score (4.37, SD 0.42) followed by aesthetics (3.74, SD 1.14). Apps that only provided information on BC prevention or management of its risk factors had lower MARS scores than those that recorded medical data or patient-generated health data. Apps that were developed >2 years ago, or by individuals, had significantly lower MARS scores compared to other apps (P<.001).ConclusionsThe quality of BC-related apps was generally acceptable according to the MARS, but the gaps between the highest- and lowest-rated apps were large. In addition, apps using personalized data were of higher quality than those merely giving related information, especially after treatment in the cancer care continuum. We also found that apps that had been updated within 1 year and developed by private companies had higher MARS scores. This may imply that there are criteria for end users and clinicians to help choose the right apps for better clinical outcomes.

Project description:BACKGROUND:Modern smartphones contain sophisticated high-end hardware features, offering high computational capabilities at extremely manageable costs and have undoubtedly become an integral part in users' daily life. Additionally, smartphones offer a well-established ecosystem that is easily discoverable and accessible via the marketplaces of differing mobile platforms, thus encouraging the development of many smartphone apps. Such apps are not exclusively used for entertainment purposes but are also commonplace in health care and medical use. A variety of those health and medical apps exist within the context of tinnitus, a phantom sound perception in the absence of any physical external source. OBJECTIVE:In this paper, we shed light on existing smartphone apps addressing tinnitus by providing an up-to-date overview. METHODS:Based on PRISMA guidelines, we systematically searched and identified existing smartphone apps on the most prominent app markets, namely Google Play Store and Apple App Store. In addition, we applied the Mobile App Rating Scale (MARS) to evaluate and assess the apps in terms of their general quality and in-depth user experience. RESULTS:Our systematic search and screening of smartphone apps yielded a total of 34 apps (34 Android apps, 26 iOS apps). The mean MARS scores (out of 5) ranged between 2.65-4.60. The Tinnitus Peace smartphone app had the lowest score (mean 2.65, SD 0.20), and Sanvello-Stress and Anxiety Help had the highest MARS score (mean 4.60, SD 0.10). The interrater agreement was substantial (Fleiss ?=0.74), the internal consistency was excellent (Cronbach ?=.95), and the interrater reliability was found to be both high and excellent-Guttman ?6=0.94 and intraclass correlation, ICC(2,k) 0.94 (95% CI 0.91-0.97), respectively. CONCLUSIONS:This work demonstrated that there exists a plethora of smartphone apps for tinnitus. All of the apps received MARS scores higher than 2, suggesting that they all have some technical functional value. However, nearly all identified apps were lacking in terms of scientific evidence, suggesting the need for stringent clinical validation of smartphone apps in future. To the best of our knowledge, this work is the first to systematically identify and evaluate smartphone apps within the context of tinnitus.

Project description:BACKGROUND:A large number of mobile health (mHealth) apps have been created to help users to manage their health or receive health care services. Many of these mHealth apps have proven to be helpful for maintaining or improving their users' health. However, many people still choose not to use mHealth apps or only use them for a short period. One of the reasons behind this lack of use is the concern for their health information security and privacy. OBJECTIVE:The goal of this study was to determine the relationship between users' characteristics and their security and privacy concerns and to identify desired security features in mHealth apps, which could reduce these concerns. METHODS:A questionnaire was designed and validated by the research team. This questionnaire was then used to determine mobile app users' security and privacy concerns regarding personal health data in mHealth apps as well as the security features most users' desire. A semistructured interview was used to identify barriers to and facilitators of adopting mHealth apps. RESULTS:In total, 117 randomly selected study participants from a large pool took part in this study and provided responses to the validated questionnaire and the semistructured interview questions. The results indicate that most study participants did have concerns about their privacy when using mHealth apps. They also expressed their preferences regarding several security features in mHealth apps, such as regular password updates, remote wipe, user consent, and access control. An association between their demographic characteristics and their concerns and preferences in security and privacy was identified; however, in most cases, the differences among the different demographic groups were not statistically significant, except for a few very specific aspects. These study participants also indicated that the cost of apps and lack of security features in mHealth apps were barriers for adoption, whereas having free apps, strong but easy-to-use security features, and clear user protection privacy policies might encourage them to use mHealth apps in their health management. CONCLUSIONS:This questionnaire and interview study verified the security and privacy concerns of mHealth app users, identified the desired security and privacy features, and determined specific barriers to and facilitators of users adopting mHealth apps. The results can be used to guide mHealth app developers to create apps that would be welcomed by users.

Project description:BackgroundThe mobile app market differs from country to country, and to date, no previous review of the content quality of smoking cessation apps has been conducted in France.ObjectiveThis study aimed to examine the general quality of the most popular smoking cessation apps in France and also determine the degree to which apps adhere to established behavioral and cognitive techniques (BCTs) proven effective in clinical practice.MethodsA systematic research of smoking cessation apps was conducted in both the Google Play Store and Apple Store in the French market. The general quality of popular apps was rated with the Mobile App Rating Scale (MARS), and the therapeutic quality was assessed with the ratio of adherence of the behavior change technique taxonomy for smoking cessation treatment.ResultsA total of 14 mobile apps met all the inclusion criteria of the content analysis. The interrater reliability varied from "substantial" (0.79) to "almost perfect" (0.9) for the two measures. The mean MARS score was 3.5 out of 5 (median 3.6, IQR 0.6 [3.2-3.8]). The findings suggest that popular apps focus primarily on the functionality dimension of the MARS scale (4.2/5). The mean number of BCTs was 22, with a large difference between apps (minimum 4, maximum 38). At least half of the apps addressed motivation (8.8/14, 63%) and advised on using behavioral skills in order to quit smoking or stay a nonsmoker (8.7/14, 62%). However, only a handful of apps gathered important information (5.9/14, 42%) in order to deliver proper advice regarding the use of approved medication or the implementation of behavioral techniques (4.3/14, 31%). The mean MARS score was positively correlated with the price (r=0.70, P=.007) and the number of BCTs used (r=0.67, P=.01). User rating was not correlated with any quality scale (P=.67).ConclusionsThe content quality of popular smoking cessation apps in France varied by app type and price. Most popular apps propose in general good quality content but lack implementation of evidence-based BCTs associated with effectiveness on smoking cessation treatment. Further research is needed to evaluate the improvement in the content quality of smoking cessation apps in France.

Dataset Information

Server-Focused Security Assessment of Mobile Health Apps for Popular Mobile Platforms.

Background

Objective

Methods

Results

Conclusions

Publications

Server-Focused Security Assessment of Mobile Health Apps for Popular Mobile Platforms.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets