Abstract
BackgroundPoor information privacy practices have been identified in health apps. Medical app accreditation programs offer a mechanism for assuring the quality of apps; however, little is known about their ability to control information privacy risks. We aimed to assess the extent to which already-certified apps complied with data protection principles mandated by the largest national accreditation program.MethodsCross-sectional, systematic, 6-month assessment of 79 apps certified as clinically safe and trustworthy by the UK NHS Health Apps Library. Protocol-based testing was used to characterize personal information collection, local-device storage and information transmission. Observed information handling practices were compared against privacy policy commitments.ResultsThe study revealed that 89 % (n = 70/79) of apps transmitted information to online services. No app encrypted personal information stored locally. Furthermore, 66 % (23/35) of apps sending identifying information over the Internet did not use encryption and 20 % (7/35) did not have a privacy policy. Overall, 67 % (53/79) of apps had some form of privacy policy. No app collected or transmitted information that a policy explicitly stated it would not; however, 78 % (38/49) of information-transmitting apps with a policy did not describe the nature of personal information included in transmissions. Four apps sent both identifying and health information without encryption. Although the study was not designed to examine data handling after transmission to online services, security problems appeared to place users at risk of data theft in two cases.ConclusionsSystematic gaps in compliance with data protection principles in accredited health apps question whether certification programs relying substantially on developer disclosures can provide a trusted resource for patients and clinicians. Accreditation programs should, as a minimum, provide consistent and reliable warnings about possible threats and, ideally, require publishers to rectify vulnerabilities before apps are released.Electronic supplementary materialThe online version of this article (doi:10.1186/s12916-015-0444-y) contains supplementary material, which is available to authorized users.
Highlights
Poor information privacy practices have been identified in health apps
We developed a coding schema based on guidance produced by the UK Information Commissioner’s Office (ICO) [30] concerning requirements established by the Data Protection Act 1998
Results of policy assessment Two-thirds (67 %, n = 53/79) of apps had some form of privacy policy (Table 3)
Summary
Medical app accreditation programs offer a mechanism for assuring the quality of apps; little is known about their ability to control information privacy risks. Mobile apps – software programs running on devices like smartphones – offer a wide range of potential medical and health-related uses [1]. They are part of a consumer phenomenon which has seen rapid uptake and evolution of mobile hardware and software. Recent privacy-focused reviews of health and wellness apps available through generic app stores have consistently identified gaps in the extent to which data uses are fully documented and appropriate security mechanisms implemented [10,11,12,13]
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
