Privacy in Smartphone Health Apps - A Case for Privacy by Design
Privacy in Smartphone Health Apps - A Case for Privacy by Design
Mobile health apps are a booming market targeted at both patients and caregivers. In a March 20, 2019 article by Lead Author Quinn Grundy of the University of Toronto in BMJ titled "Data sharing practices of medicines related apps and the mobile ecosystem: traffic, content, and network analysis" found that 19 of 24 samples of interactive apps available in United States, Canada, Australia and the UK, that specifically pertained to medication information, dispensing, prescribing, use, symptoms and conditions, was shared surprising amount personal health data with third parties on a routine basis.
The 24 applications were run through a series of simulation tests using dummy user profiles to establish a data sharing behaviour. Then, 28 pre-specified sources sensitive user data were altered in each tested app including such identifiable items as Date of Birth and drug list. Through analysis of network traffic and identification of IP destinations from the devices following the changes, it was found in many cases that key identifiable personal health information was routinely shared with third party entities. In a CBC News report, even the lead author, Quinn Grundy of the University of Toronto's school of nursing, admitted she was surprised at how freely the data was being passed on to other companies, given the nature of the information. "We'd hoped that health data would be treated as personal and sensitive and I think we're disappointed to see that the kind of sharing going on was really 'business as usual' as for any other kind of app."
During the installation process, users are required to grant app developers permission to start collecting personal information. In all cases, the type of permission granted was considered "dangerous" by Android's own security standards for developers. The most commonly collected information by apps was about: the devices they were downloaded on; the operating system; browsing activity; list of drugs entered by the user. In a few cases, extremely sensitive data was also scooped up, such as the name of the user's doctor and pharmacy, as well as "feelings" they were experiencing.
It was reported that in most cases, app developers aren't actually selling the data to third parties for money. Instead, it's a free trade, whereby third parties like Google, Crashlytics and Apptimize retain the right to collect user data in exchange for providing app developers services such as cloud storage. These arrangements are sometimes called '"freemium services."
A few medication apps can link with users' Facebook accounts, creating another avenue for personal data to be connected and shared. In most cases, the data is anonymized. But users shouldn't be confident in thinking they won't be identified. The data-sharing often doesn't end with third parties if that third party happens to be Google, for example. Google shares data with what Grundy refers to as "fourth parties" — business partners that have the ability to perform sophisticated data analysis. "And so we could see user data kind of travelling through this mobile ecosystem and these big players at the centre of it able to aggregate and potentially re-identify users," she said. Grundy added, although users consent to sharing data, and none of the activity is illegal, users are likely unaware of what happens to that information after it's passed along to third parties and beyond. The same goes for app developers.
Because this is a booming market many developers are no doubt working on the next generation of mobile health apps. Falling into the trap that these well-known and respected apps have fallen into should be avoided in the development in new applications. Thinking trough the privacy implications of the application and the data it contains should be an integrated part of the original design of concepts and ‘privacy by design’ should become an integral part of the development process and marketing of the application.
Users also need to be aware of the apps privacy policies since "It's carefully worded fuzzy language that essentially allows wide latitude for an organization to use the information.".
Links:
https://www.bmj.com/content/364/bmj.l920
https://www.cbc.ca/news/health/medication-apps-share-data-1.5068629
Add A Comments