Security Recommendations for mHealth Apps: Elaboration of a Developer's Guide

Area of Science:

• Health Informatics
• Mobile Technology
• Cybersecurity

Background:

• Mobile health (mHealth) apps represent a fast-growing sector, significantly impacting healthcare delivery through Big Data analysis.
• A critical concern is the prevalent lack of robust security measures in mHealth apps during data collection and handling.
• This vulnerability poses significant risks to sensitive patient information.

Purpose of the Study:

• To present a comprehensive security guide for mHealth app developers.
• To address the widespread security weaknesses identified in current mobile health applications.
• To facilitate the implementation of effective security measures for all mHealth app types.

Main Methods:

• Conducted a systematic search of mHealth apps in major app stores (e.g., Android Google Play, Apple iTunes) in August 2015.
• Classified apps based on their usefulness and identified prevalent security weaknesses.
• Analyzed security vulnerabilities using resources from the OWASP Mobile Security Project, the Office of Civil Rights (OCR), and scientific literature.

Main Results:

• Identified significant security gaps in the development of mHealth applications.
• Developed a tiered security framework categorizing apps into high (monitoring, diagnosis, treatment), medium (calculator, localizer, alarm), and low (informative, educational) risk levels.
• Provided actionable security implementation guidance tailored to data manipulation and risk assessment for each level.

Conclusions:

• A structured security guide is essential for developers, especially those outside of Information and Communication Technology (ICT) and professional health fields.
• Implementing layered security measures based on data risk is crucial for safeguarding mHealth applications.
• The guide aims to ensure and simplify security best practices in mHealth app development.