Analyzing security issues of android mobile health and medical applications
Open accessAbstract
Objective: We conduct a first large-scale analysis of mobile health (mHealth) apps available on Google Play with the goal of providing a comprehensive view of mHealth apps’ security features and gauging the associated risks for mHealth users and their data. Materials and Methods: We designed an app collection platform that discovered and downloaded more than 20 000 mHealth apps from the Medical and Health & Fitness categories on Google Play. We performed a suite of app code and traffic measurements to highlight a range of app security flaws: certificate security, sensitive or unnecessary permission requests, malware presence, communication security, and security-related concerns raised in user reviews. Results: Compared to baseline non-mHealth apps, mHealth apps generally adopt more reliable signing mechanisms and request fewer dangerous permissions. However, significant fractions of mHealth apps expose users to serious security risks. Specifically, 1.8% of mHealth apps package suspicious codes (eg, trojans), 45.0% rely on unencrypted communication, and as much as 23.0% of personal data (eg, location information and passwords) is sent on unsecured traffic. An analysis of the app reviews reveals that mHealth app users are largely unaware of the surfaced security issues. Conclusion: Despite being better aligned with security best practices than non-mHealth apps, mHealth apps are still far from ensuring robust security guarantees. App users, clinicians, technology developers, and policy makers alike should be cognizant of the uncovered security issues and weigh them carefully against the benefits of mHealth apps.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Out of 20 000 apps from Google Play studied, 45% rely on unencrypted communication, and 23% of personal data (e.g., location information and passwords) are sent on unsecured traffic.
“For example, out of 20 000 apps from Google Play studied in [202] it was revealed that 45% of the apps rely on unencrypted communication, and as much as 23% of personal data (e.g. location information and passwords) are sent on unsecured traffic.”
From Human-centred artificial intelligence for mobile health sensing: challenges and opportunities (2023) · cites this paper as [202]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks
Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L., & Kirda, E. (2015) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-20550-2_1 · Cited by 458 · see citing works
What is the clinical value of mHealth for patients?
Rowland, S. P., Fitzgerald, J. E., Holme, T., Powell, J., & McGregor, A. (2020) · npj Digital Medicine · doi:10.1038/s41746-019-0206-x · Cited by 454 · see citing works
Huckvale, K., Prieto, J. T., Tilney, M., Benghozi, P.-J., & Car, J. (2015) · BMC Medicine · doi:10.1186/s12916-015-0444-y · Cited by 376 · see citing works
Proceedings of the 18th ACM conference on Computer and communications security
Chen, Y., Danezis, G., & Shmatikov, V. (2011) · doi:10.1145/2046707 · Cited by 339 · see citing works
Huckvale, K., Torous, J., & Larsen, M. E. (2019) · JAMA Network Open · doi:10.1001/jamanetworkopen.2019.2542 · Cited by 312 · see citing works
Akbar, S., Coiera, E. W., & Magrabi, F. (2019) · Journal of the American Medical Informatics Association · doi:10.1093/jamia/ocz175 · Cited by 246 · see citing works
Dehling, T., Gao, F., Schneider, S., & Sunyaev, A. (2015) · JMIR mHealth and uHealth · doi:10.2196/mhealth.3672 · Cited by 243 · see citing works
Security and Privacy Analysis of Mobile Health Applications: The Alarming State of Practice
Papageorgiou, A., Strigkos, M., Politou, E., Alepis, E., Solanas, A., & Patsakis, C. (2018) · IEEE Access · doi:10.1109/access.2018.2799522 · Cited by 236 · see citing works
Tighe, J., Shand, F., Ridani, R., Mackinnon, A., De La Mata, N., & Christensen, H. (2017) · BMJ Open · doi:10.1136/bmjopen-2016-013518 · Cited by 227 · see citing works
Ren, J., Rao, A., Lindorfer, M., Legout, A., & Choffnes, D. (2016) · International Conference on Mobile Systems, Applications, and Services · doi:10.1145/2906388.2906392 · Cited by 222 · see citing works
Grundy, Q., Chiu, K., Held, F., Continella, A., Bero, L., & Holz, R. (2019) · BMJ · doi:10.1136/bmj.l920 · Cited by 164 · cited 1× · see citing works
“Grundy et al analyzed the recipients of user data collected by 24 medical apps.(14) While addressing data-collection practices and user data recipients, these works have a limited focus on the exposure of mHealth apps to security threats and their malicious behavior.”
BackgroundBartel, A., Klein, J., Traon, Y. L., & Monperrus, M. (2012) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/2351676.2351722 · Cited by 139 · see citing works
An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps
Ikram, M., Vallina-Rodríguez, N., Seneviratne, S., Kâafar, M. A., & Paxson, V. (2016) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2987443.2987471 · Cited by 129 · see citing works
Self-citationWang, H., Liu, Z., Liang, J., Vallina-Rodríguez, N., Guo, Y., Li, L., Tapiador, J., Cao, J., & Xu, G. (2018) · ACM Internet Measurement Conference (IMC) · doi:10.1145/3278532.3278558 · Cited by 120 · see citing works
Euphony: Harmonious Unification of Cacophonous Anti-Virus Vendor Labels for Android Malware
Hurier, M., Suárez‐Tangil, G., Dash, S. K., Bissyandé, T. F., Traon, Y. L., Klein, J., & Cavallaro, L. (2017) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr.2017.57 · Cited by 104 · see citing works
Security Concerns in Android mHealth Apps.
He, D., Naveed, M., Gunter, C. A., & Nahrstedt, K. (2014) · PubMed Central · Cited by 101 · see citing works
Privacy Policies of Android Diabetes Apps and Sharing of Health Information.
Blenner, S. R., Köllmer, M., Rouse, A., Daneshvar, N., Williams, C., & Andrews, L. (2016) · Journal of the American Medical Association (JAMA) · doi:10.1001/jama.2015.19426 · Cited by 98 · see citing works
Kantchelian, A., Tschantz, M. C., Afroz, S., Miller, B., Shankar, V., Bachwani, R., Joseph, A. D., & Tygar, J. D. (2015) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/2808769.2808780 · Cited by 93 · see citing works
Divide-and-Conquer: Why Android Malware Cannot Be Stopped
Maier, D., Müller, T., & Protsenko, M. (2014) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2014.12 · Cited by 58 · see citing works
Automated test input generation for android: towards getting there in an industrial case
Zheng, H., Li, D., Liang, B., Zeng, X., Zheng, W., Deng, Y., Lam, W., Yang, W. M., & Xie, T. (2017) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip.2017.32 · Cited by 57 · see citing works
Ren, J., Lindorfer, M., Dubois, D. J., et al. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23143 · Cited by 56 · see citing works
Security of mobile health (mHealth) systems
Zubaydi, F., Saleh, A., Aloul, F., & Sagahyroon, A. A. (2015) · IEEE International Conference on Bioinformatics and Bioengineering (BIBE) · doi:10.1109/bibe.2015.7367689 · Cited by 55 · see citing works
The Chain of Implicit Trust: An Analysis of the Web Third-party Resources Loading
Ikram, M., Masood, R., Gareth Tyson, A., Kâafar, M. A., Loizon, N., & Ensafi, R. (2019) · International World Wide Web Conference (WWW) · doi:10.1145/3308558.3313521 · Cited by 51 · see citing works
Self-citationA first look at mobile Ad-Blocking apps
Ikram, M., & Kâafar, M. A. (2017) · IEEE International Symposium on Network Computing and Applications (NCA) · doi:10.1109/nca.2017.8171376 · Cited by 31 · see citing works
Self-citationMercurio, M., Larsen, M. E., Wisniewski, H., Henson, P., Lagan, S., & Torous, J. B. (2020) · Evidence-Based Mental Health · doi:10.1136/ebmental-2019-300137 · Cited by 23 · see citing works
Causality-based Sensemaking of Network Traffic for Android Application Security
Zhang, H., Yao, D. D., & Ramakrishnan, N. (2016) · ACM Workshop on Artificial Intelligence and Security (AISec) · doi:10.1145/2996758.2996760 · Cited by 13 · see citing works
Ren, J., Rao, A., Lindorfer, M., Legout, A., & Choffnes, D. (2016) · Annual International Conference on Mobile Systems, Applications, and Services Companion (MobiSys Companion) · doi:10.1145/2938559.2938563 · Cited by 9 · see citing works
AVclass: A Tool for Massive Malware Labeling
Sebastián, M., Rivera, R., Kotzias, P., & Caballero, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-45719-2_11
Flagged first, then by citations
Research works printed but not linked: 5
- [2]Kay M, Santos J, Takane.mHealth: New Horizons for Health through Mobile Technologies, vol 64, Geneva, Switzerland: World Health Organization; 2011, pp 66–71. [Google Scholar]
- [20]Tang Z, Tang K, Xue M, et al. iOS, Your OS, Everybody’s OS: Vetting and Analyzing Network Services of iOS Apps. In: proceedings of the 29th Usenix Security Symposium (Usenix Security). 2020.
- [28]Arp D, Spreitzenbarth M, Hübner M, Gascon H, Rieck K. Drebin: effective and explainable detection of android malware in your pocket. In: proceedings of the Conference: Network and Distributed System Security Symposium (NDSS). San Diego, California, USA: 21st Annual Network and Distributed System Security Symposium (NDSS), February 23-26, 2014, 2014.
- [57]Jon O, Miller C.. Dissecting the android bouncer. SummerCon2012, New York 2012; 95: 110. [Google Scholar] eweekdev. Google Bouncer Vulnerabilities Probed by Security Researchers. 2012. https://www.eweek.com/security/google-bouncer-vulnerabilities-probed-by-security-researchers/ (Accessed February 5, 2021).
- [61]Ren J, Lindorfer M, Dubois DJ, Rao A, Choffnes DR, Vallina-Rodriguez N. Bug fixes, improvements, … and privacy leaks: A longitudinal study of pii leaks across android app versions. In: Proceedings of Network and Distributed System Security Symposium. 2018.
Cited by
Sorted by citations
Nawshin, F., Gad, R., Ünal, D., Al-Ali, A. K., & Suganthan, P. N. (2024) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2024.109233 · Cited by 56 · see citing works
Gasteiger, N., Dowding, D., Norman, G., McGarrigle, L., Eost‐Telling, C., Jones, D. J., Vercell, A., Ali, S. M., & O’Connor, S. (2023) · BMJ Open · doi:10.1136/bmjopen-2023-073283 · Cited by 37 · see citing works
Human-centred artificial intelligence for mobile health sensing: challenges and opportunities
Dang, T., Spathis, D., Ghosh, A., & Mascolo, C. (2023) · Royal Society Open Science · doi:10.1098/rsos.230806 · Cited by 30 · see citing works
Macrynikola, N., Nguyen, N. S., Lane, E., Yen, S., & Torous, J. B. (2023) · NEJM Catalyst · doi:10.1056/cat.23.0100 · Cited by 30 · see citing works
Fede, O. D., Mantia, G. L., Cimino, M. G. C. A., & Campisi, G. (2023) · Oral · doi:10.3390/oral3020014 · Cited by 18 · see citing works
Current challenges for evaluating mobile health applications
Alon, N., & Torous, J. B. (2022) · Journal of the American Medical Informatics Association · doi:10.1093/jamia/ocac244 · Cited by 17 · see citing works
Ruzi, R., Pan, Y., Ng, M. L., Su, R., Wang, L., Dang, J., Liu, L., & Yan, N. (2025) · Bioengineering · doi:10.3390/bioengineering12020108 · Cited by 9 · see citing works
Implementation of Telemedicine for Patients With Dementia and Their Caregivers: Scoping Review
Ye, M., Liu, Z., Xie, W., Shou, M., Wang, S. J., Lin, X., Xu, Y., Yao, M., Chen, J., Shou, Y., et al. (2025) · Journal of Medical Internet Research · doi:10.2196/65667 · Cited by 9 · see citing works
Mapping Cyber Attacks on the Internet of Medical Things: A Taxonomic Review
Kondeti, V., & Bahşi, H. (2024) · International Conference on System of Systems Engineering · doi:10.1109/sose62659.2024.10620925 · Cited by 8 · see citing works
Post-mortem digital forensic analysis of the Garmin Connect application for Android
Nunes, F., Domingues, P., & Frade, M. (2023) · Forensic Science International Digital Investigation · doi:10.1016/j.fsidi.2023.301624 · Cited by 8 · see citing works
Towett, G., Snead, R. S., Marczika, J., Ambalavanan, R., Mbogori-Kairichi, M., & Malioukis, A. (2025) · Digital Health · doi:10.1177/20552076251406654 · Cited by 10 · see citing works
An Empirical Analysis of Security and Privacy Risks in Android Cryptocurrency Wallet Apps
Sentana, I. W. B., Ikram, M., & Kâafar, M. A. (2023) · Lecture notes in computer science · doi:10.1007/978-3-031-33491-7_26 · Cited by 7 · see citing works
Self-citationProposal of a New Rating Concept for Digital Health Applications in Orthopedics and Traumatology
Scherer, J. N., Youssef, Y., Dittrich, F., Albrecht, U., Tsitsilonis, S., Jung, J., Pförringer, D., Landgraeber, S., Beck, S., & Back, D. A. (2022) · International Journal of Environmental Research and Public Health · doi:10.3390/ijerph192214952 · Cited by 7 · see citing works
Xie, Z., Or, C. K., & Ye, X. (2025) · Applied Ergonomics · doi:10.1016/j.apergo.2025.104655 · Cited by 6 · see citing works
Henry, S. B. (2021) · Journal of the American Medical Informatics Association · doi:10.1093/jamia/ocab188 · Cited by 6 · see citing works
Huettemann, R., Sevov, B., Meister, S., & Fehring, L. (2024) · Digital Health · doi:10.1177/20552076241255929 · Cited by 6 · see citing works
Security Analysis of Top-Ranked mHealth Fitness Apps: An Empirical Study
Forsberg, A., & Iwaya, L. H. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-79007-2_19 · Cited by 4 · see citing works
Teledentistry: An Appraisal of Google Play Store Applications
Mujtaba, H., Umer, M. F., Afroze, E., Chaudhary, F. A., Zofeen, S., & Farid, A. (2023) · European Journal of General Dentistry · doi:10.1055/s-0043-1761931 · Cited by 4 · see citing works
A Study of User Concerns about Smartphone Privacy
Fung, C., Motti, V. G., Zhang, K., & Qian, Y. (2022) · Cyber Security in Networking Conference (CSNet) · doi:10.1109/csnet56116.2022.9955623 · Cited by 3 · see citing works
Assessing the Security Risks of Medical Mobile Applications
Chatzisofroniou, G., Markellos, C., & Kotzanikolaou, P. (2023) · IEEE Symposium on Computers and Communications (ISCC) · doi:10.1109/iscc58397.2023.10217984 · Cited by 3 · see citing works
Wang, S., Yin, X., Liu, P., & Yang, J. (2025) · Healthcare and Rehabilitation · doi:10.1016/j.hcr.2025.100035 · Cited by 2 · see citing works
Bahrini, M., Herbst, A., Freye, M., Kohn, M., Sohr, K., & Malaka, R. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-07901-5_1 · Cited by 2 · see citing works
Measuring the Security of Indonesian Local Goverment Mobile Apps
Sentana, I. W. B., Ciptayani, P. I., & Dewi, K. C. (2024) · Procedia Computer Science · doi:10.1016/j.procs.2024.03.136 · Cited by 2 · see citing works
Self-citationTransforming Healthcare Delivery: An Android Application Approach
Saluja, P., Yadav, N., Dhiman, P., Devagan, V., Singh, P., & Singla, E. S. (2024) · International Conference on Computational Intelligence and Communication Technologies (CCICT) · doi:10.1109/ccict62777.2024.00106 · Cited by 2 · see citing works
Raheja, A., & Belani, K. G. (2025) · Anesthesiology Clinics · doi:10.1016/j.anclin.2025.05.011 · Cited by 2 · see citing works
Security and Privacy Policy of Mobile Device Application Management System
Kumar, P., Singh, S. K., Ramaswamy, S., Golhar, D., & Kirubakaran, D. (2023) · Lecture notes in networks and systems · doi:10.1007/978-981-99-3177-4_9 · Cited by 2 · see citing works
Gasteiger, N., Dowding, D., Norman, G., McGarrigle, L., Eost‐Telling, C., Jones, D. J., Vercell, A., Ali, S. M., & O’Connor, S. (2023) · Research Square · doi:10.21203/rs.3.rs-2647200/v1 · Cited by 2 · see citing works
Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications
Titiakarawongse, C., Taksin, S., Ruangsawat, J., Deeduangpan, K., & Boonkrong, S. (2024) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp4030031 · Cited by 1 · see citing works
Turugare, R., Shava, F. B., & Chitauro, M. (2025) · Lecture notes in networks and systems · doi:10.1007/978-981-96-5214-3_11 · Cited by 1 · see citing works
Shree, A. N. R., Macharla, S. R., Monteiro, D. H., Yathin, K. N., Vishwanath, H., & Biradar, A. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-3306-9.ch009 · Cited by 1 · see citing works
Turugare, R., Shava, F. B., & Chitauro, M. (2023) · International Conference on Emerging Trends in Networks and Computer Communications (ETNCC) · doi:10.1109/etncc59188.2023.10284944 · Cited by 1 · see citing works
Arikan, K., & Yılmaz, E. N. (2025) · Applied Sciences · doi:10.3390/app15052665 · Cited by 1 · see citing works
Ikram, M., Sentana, I. W. B., Asghar, H. J., Kâafar, M. A., & Kepkowski, M. (2024) · Lecture notes in computer science · doi:10.1007/978-981-96-0576-7_14
Self-citationAuditing and Attributing Behaviours of Suspicious Android Health Applications
Salman, M., Sentana, I. W. B., Ikram, M., & Kâafar, M. A. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-3531-3_12
Self-citationThe Role of Mobile Applications in the Management of Traumatic Upper Limb Injuries
Llamas-Alonso, C., Méndez, J. A. J., Puertas-Miranda, D., & Sánchez, J. Á. S. (2025) · Lecture notes in educational technology · doi:10.1007/978-981-96-5658-5_20
Secure Smart Nutrition Systems
Saha, T., Bhattacharjee, S., Thakur, K., Akhtar, A., & Ghosh, J. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-5258-9.ch009
AlcoCircle: Framework for Alcohol Tracking Applications
Vigh, E., & Eardley, R. (2026) · ACM Interactive Health Conference · doi:10.1145/3786579.3804908
On the evolution of security and privacy in Android health APIs
Pérez-Fuente, A., Martínez-González, M. M., & Bustos-Jiménez, J. (2026) · Frontiers in Digital Health · doi:10.3389/fdgth.2026.1818536
- Authors
- Tangari, G., Ikram, M., Sentana, I. W. B., Ijaz, K., Kaafar, M. A., & Berkovsky, S.
- Affiliations
- Macquarie University (AU)
- Centre for Health Informatics, Australian Institute of Health Innovation, Macquarie
- Department of Computing, Macquarie University, Sydney, Australia
- Corresponding author
- Ikram, Muhammad
- Venue
- Journal of the American Medical Informatics Association
- Publisher
- Oxford University Press (OUP)
- Published
- 2021-08-12
- Volume
- 28
- Issue
- 10
- Pages
- 2074-2084
- ISSN
- 1067-5027 (ISSN-L)
- 1527-974X
- PMC
- PMC8449631
- OpenAlex
- W3188843181
- Cited by
- 38
- References
- 19
- Citations by year
- 2026: 3 · 2025: 13 · 2024: 7 · 2023: 11 · 2022: 3 · 2021: 1
- FWCI
- 2.57
- Type
- journal article
- Language
- en
- Open access
- green
- www.ncbi.nlm.nih.gov
- Licence
- academic.oup.com/journals/pages/open_access/funder_policies/chorus/standard_publication_model (vor)
- Locations
- Journal of the American Medical Informatics Association (publishedVersion)
- PubMed Central (publishedVersion)
- PubMed (publishedVersion)
- Figshare (submittedVersion, cc-by)
- Funders
- Optus Macquarie University Cyber Security Hub
- National Health and Medical Research Council (APP1134919)
- Macquarie University
- Topics
- Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
- Health Sciences › Health Professions › General Health Professions › Mobile Health and mHealth Applications
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- mobile health apps, mobile application security, Google Play Store, permission requests, malware, Trojans, sensitive data exposure, online reviews, app reviews
- MeSH terms
- Administrative Personnel, Communication, Humans, Exercise, Telemedicine, Mobile Applications
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
