Most health apps fail to meet legal requirements or put millions of users’ privacy and security at risk, a European study has revealed.
Researchers from the University of Piraeus, Greece and Rovira I Virgili University, Spain, said analysis of 20 popular, free mobile health apps, available on Google Play, found that 80% transmitted health-related data to third-party companies, with only half doing so over secure (HTTPS) connections.
Most of the apps did not meet legal requirements or standards meant to prevent users’ inappropriate and uncontrolled data usage and disclosure to third-party companies.
The research team analysed the way in which users’ personal data were handled and discovered that only 20% of the apps stored data on users’ smartphones, while one in two requested and managed users’ login passwords without using a secure connection.
Half of the apps shared personal data – both text data and multimedia such as X-ray images – with third parties and more than half transmitted users’ health data through URL links.
One-fifth of apps either did not refer users to a privacy policy, or the policy content was not available in English, while others required access to users’ geolocation, microphones, camera, contacts list, external storage card or Bluetooth, even though functionality did not depend on it.
Dr Agusti Solanas, of Rovira I Virgili University, said: “We strongly support the use of mobile health apps, but users must know that apps’ popularity does not ensure privacy and security. People need to become more aware of the risks they are facing.”
The researchers informed the app developers about their findings and some issues, such as unsafe health data transfers or the possibility of identifying users because of unsafe data transfers to third parties, were fixed. Concerns raised about app usage data leaks were not addressed.
Achilleas Papageorgiou A, Strigkos M, Politou E et al. Security and Privacy Analysis of Mobile Health Applications: The Alarming State of Practice. IEEEXplore. 29 January 2018; doi: 10.1109/ACCESS.2018.2799522 [abstract]
Leave a Reply