The DOI matches its Crossref record; 27 of the 28 references it cites were found in a registry or an index.
Security and Privacy Analysis of Mobile Health Applications: The Alarming State of Practice
Open accessAbstract
Recent advances in hardware and telecommunications have enabled the development of low cost mobile devices equipped with a variety of sensors. As a result, new functionalities, empowered by emerging mobile platforms, allow millions of applications to take advantage of vast amounts of data. Following this trend, mobile health applications collect users health-related information to help them better comprehend their health status and to promote their overall wellbeing. Nevertheless, health-related information is by nature and by law deemed sensitive and, therefore, its adequate protection is of substantial importance. In this paper we provide an in-depth security and privacy analysis of some of the most popular freeware mobile health applications. We have performed both static and dynamic analysis of selected mobile health applications, along with tailored testing of each application's functionalities. Long term analyses of the life cycle of the reviewed apps and our general data protection regulation compliance auditing procedure are unique features of the present paper. Our findings reveal that the majority of the analyzed applications do not follow well-known practices and guidelines, not even legal restrictions imposed by contemporary data protection regulations, thus jeopardizing the privacy of millions of users.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“others report concerns from the point of view of security, privacy, and ethical implications [14,15].”
From A conversational artificial intelligence agent for a mental health care app: Evaluation study of its participatory design (2021) · cites this paper as [14]
Citations
Cites
Emmers, E. (2019) · SGEM International Multidisciplinary Scientific Conferences on Social Sciences and Arts · doi:10.5593/sgemsocial2019v/1.1 · Cited by 1,317
Mobile devices and apps for health care professionals: uses and benefits.
Ventola, C. L. (2014) · PubMed Central · doi:10.57945/manara.23966214 · Cited by 847
Smart health: A context-aware health paradigm within smart cities
Solanas, A., Patsakis, C., Conti, M., Vlachos, I. S., Ramos, V., Falcone, F., Postolache, O. A., Pérez‐Martínez, P., Pietro, R. D., Perrea, D. N., et al. (2014) · IEEE Communications Magazine · doi:10.1109/mcom.2014.6871673 · Cited by 596
Self-citationWhy eve and mallory love android
Fahl, S., Harbach, M., Muders, T., Baumgärtner, L., Freisleben, B., & Smith, M. (2012) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2382196.2382205 · Cited by 508
Enabling the Internet of Things
Want, R., Schilit, B. N., & Jenson, S. (2015) · Computer · doi:10.1109/mc.2015.12 · Cited by 444
ARTICLE 29 Data Protection Working Party
Sotiropoulos, D. M. (2013) · Cited by 434
Huckvale, K., Prieto, J. T., Tilney, M., Benghozi, P.-J., & Car, J. (2015) · BMC Medicine · doi:10.1186/s12916-015-0444-y · Cited by 376
Availability and quality of mobile health app privacy policies
Sunyaev, A., Dehling, T., Taylor, P. L., & Mandl, K. D. (2015) · Journal of the American Medical Informatics Association · doi:10.1136/amiajnl-2013-002605 · Cited by 360
Analyzing Android Encrypted Network Traffic to Identify User Actions
Conti, M., Mancini, L., Spolaor, R., & Verde, N. V. (2016) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2015.2478741 · Cited by 275
Dehling, T., Gao, F., Schneider, S., & Sunyaev, A. (2015) · JMIR mHealth and uHealth · doi:10.2196/mhealth.3672 · Cited by 243
The new General Data Protection Regulation: still a sound system for the protection of individuals?
de Hert, P., & Papakonstantinou, V. (2016) · Computer Law & Security Review · doi:10.1016/j.clsr.2016.02.006 · Cited by 211
Longitudinal Analysis of Android Ad Library PermissionsPreprint
Book, T., Pridgen, A., & Wallach, D. S. (2013) · arXiv (Cornell University) · doi:10.48550/arxiv.1303.0857 · Cited by 175
Learning Internet-of-Things Security "Hands-On"
Kolias, C., Stavrou, A., Voas, J. M., Bojanova, I., & Kuhn, R. (2016) · IEEE Security & Privacy · doi:10.1109/msp.2016.4 · Cited by 125
Security Concerns in Android mHealth Apps.
He, D., Naveed, M., Gunter, C. A., & Nahrstedt, K. (2014) · PubMed Central · Cited by 101
Security and Privacy Issues Related to the Use of Mobile Health Apps
Adhikari, R., Richards, D., & Scott, K. M. (2014) · Tuwhera (Auckland University of Technology) · Cited by 72
Going Mobile: How Mobile Personal Health Records Can Improve Health Care During Emergencies
Bouri, N., & Ravi, S. (2014) · JMIR mhealth and uhealth · doi:10.2196/mhealth.3017 · Cited by 67
SoK: Privacy on Mobile Devices – It’s Complicated
Spensky, C., Stewart, J., Yerukhimovich, A., Shay, R., Trachtenberg, A., Housley, R., & Cunningham, R. K. (2016) · Proceedings on Privacy Enhancing Technologies · doi:10.1515/popets-2016-0018 · Cited by 50
Book, T., & Wallach, D. S. (2013) · doi:10.1145/2516760.2516762 · Cited by 49
Security testing for Android mHealth apps
Knorr, K., & Aspinall, D. (2015) · IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) · doi:10.1109/icstw.2015.7107459 · Cited by 47
Playing Hide and Seek with Mobile Dating Applications
Qin, G., Patsakis, C., & Bouroche, M. (2014) · IFIP advances in information and communication technology · doi:10.1007/978-3-642-55415-5_15 · Cited by 35
Self-citationOpen Doors for Bob and Mallory: Open Port Usage in Android Apps and Security Implications
Jia, Y. J., Chen, Q. A., Lin, Y., Kong, C., & Mao, Z. M. (2017) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp.2017.44 · Cited by 30
On the Privacy, Security and Safety of Blood Pressure and Diabetes Apps
Knorr, K., Aspinall, D., & Wolters, M. K. (2015) · IFIP advances in information and communication technology · doi:10.1007/978-3-319-18467-8_38 · Cited by 27
Hey Doc, Is This Normal?: Exploring Android Permissions in the Post Marshmallow Era
Alepis, E., & Patsakis, C. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-71501-8_4 · Cited by 22
Self-citationPrivacy and Security for Multimedia Content shared on OSNs: Issues and Countermeasures
Patsakis, C., Zigomitros, A., Papageorgiou, A., & Solanas, A. (2014) · The Computer Journal · doi:10.1093/comjnl/bxu066 · Cited by 17
Self-citationAnalysis of Privacy and Security Exposure in Mobile Dating Applications
Patsakis, C., Zigomitros, A., & Solanas, A. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-25744-0_13 · Cited by 17
Self-citationRecent Advances in Healthcare Software: Toward Context-Aware and Smart Solutions
Solanas, A., Weber, J. H., Bener, A., van der Linden, F., & Capilla, R. (2017) · IEEE Software · doi:10.1109/ms.2017.4121202 · Cited by 13
Self-citationThere’s Wally! Location Tracking in Android without Permissions
Alepis, E., & Patsakis, C. (2017) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0006125502780284 · Cited by 11
Self-citation
Research works printed but not linked: 10
- commission, 2017, Draft Code of Conduct on Privacy for Mobile Health Applications
- commission, 2017, Green Paper on Mobile Health (‘mHealth’)
- 2017, Annex—Health Data in Apps and Devices
- timmers, 2017, ARTICLE 29 Data Protection Working Party
- 2017, Article 29 Working Party
- 2017, Guide to Protecting the Confidentiality of Personally Identifiable Information
- 2015, Special Eurobarometer 431 Data Protection Directorate-General for Communication
- 2016, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46, Official J Eur Union, 59, 1
- 1995, Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data on the free movement of such data
- 2016, Developers and Publishers are Flocking to the mHealth App Market BI Intelligence
Cited by
Sorted by citations
Zhou, L., Bao, J., Watzlaf, V., & Parmanto, B. (2019) · JMIR mHealth and uHealth · doi:10.2196/11223 · Cited by 246
Reviewing the data security and privacy policies of mobile apps for depression
O'Loughlin, K., Neary, M., Adkins, E. C., & Schueller, S. M. (2019) · Internet Interventions · doi:10.1016/j.invent.2018.12.001 · Cited by 179
Internet of Things for Healthcare Using Effects of Mobile Computing: A Systematic Literature Review
Nazir, S., Ali, Y., Ullah, N., & García‐Magariño, I. (2019) · Wireless Communications and Mobile Computing · doi:10.1155/2019/5931315 · Cited by 175
Knitza, J., Taşçılar, K., Meßner, E.-M., Meyer, M., Vossen, D., Pulla, A., Bösch, P., Kittler, J., Kleyer, A., Sewerin, P., et al. (2019) · JMIR mhealth and uhealth · doi:10.2196/14991 · Cited by 170
Grundy, Q., Chiu, K., Held, F., Continella, A., Bero, L., & Holz, R. (2019) · BMJ · doi:10.1136/bmj.l920 · Cited by 164
Metadata
- Authors
- Papageorgiou, A., Strigkos, M., Politou, E., Alepis, E., Solanas, A., & Patsakis, C.
- Affiliations
- University of Piraeus (GR)
- Venue
- IEEE Access
- Published
- 2018
- Volume
- 6
- Pages
- 9390-9403
- ISSN
- 2169-3536 (ISSN-L)
- OpenAlex
- W2787835938
- Cited by
- 236
- References
- 28
- Citations by year
- 2026: 11 · 2025: 27 · 2024: 25 · 2023: 33 · 2022: 34 · 2021: 30 · 2020: 35 · 2019: 30 · 2018: 11
- FWCI
- 40.47
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Locations
- IEEE Access (publishedVersion)
- Rovira & Virgili repository (submittedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Funders
- European Commission under the Horizon 2020 Programme (H2020)
- OPERANDO project (653704)
- CRYPTACUS COST action (COST Action IC1403)
- Topics
- Health Sciences › Health Professions › General Health Professions › Mobile Health and mHealth Applications
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- mobile health apps, privacy, security analysis, health data protection, data protection regulation, static and dynamic analysis, application life cycle, compliance audit, sensitive user data
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
