Health-care professionals should reasonably assume that data from behaviour-changing apps will be “shared with commercial entities whose own privacy practices have been questioned”, according to the authors of a new study.
They recommend only prescribing and using apps that have been carefully scrutinised to make sure they are not sneakily sharing information.
“Because most health apps fall outside government regulation, up-to-date technical scrutiny is essential for informed decision making by consumers and health care professionals wishing to prescribe health apps,” they write in a paper published in the journal JAMA Network Open.
The study was led by Kit Huckdale from the University of New South Wales, Australia.
“Data sharing with third parties that includes linkable identifiers is prevalent and focused on services provided by Google and Facebook,” the researchers write.
“Despite this, most apps offer users no way to anticipate that data will be shared in this way. As a result, users are denied an informed choice about whether such sharing is acceptable to them.
“Privacy assessments that rely solely on disclosures made in policies, or are not regularly updated, are unlikely to uncover these evolving issues. This may limit their ability to offer effective guidance to consumers and health care professionals.”
Huckdale and colleagues say their findings are topical because of contemporary concerns about the privacy practices of certain commercial entities, and in respect to current efforts to establish accreditation programs for mental health apps that account for privacy and transparency concerns.
“Our data highlight that, without sustained and technical efforts to audit actual data transmissions, relying solely on either self-certification or policy audit may fail to detect important privacy risks,” they write.
“The emergence of a services landscape in which a small number of commercial entities broker data for large numbers of health apps underlines both the dynamic nature of app privacy issues and the need for continuing technical surveillance for novel privacy risks if users and health care professionals are to be offered timely and reliable guidance.”
More broadly, the researchers suggest the tension between personal privacy and data capture by health-care apps is largely driven by the business models of the makers.
“Because many national health payers and insurance companies do not yet cover apps (given their often nascent evidence base), selling either subscriptions or users’ personal data is often the only path toward sustainability,” they conclude.
Nick Carne is the editor of Cosmos Online and editorial manager for The Royal Institution of Australia.
Read science facts, not fiction...
There’s never been a more important time to explain the facts, cherish evidence-based knowledge and to showcase the latest scientific, technological and engineering breakthroughs. Cosmos is published by The Royal Institution of Australia, a charity dedicated to connecting people with the world of science. Financial contributions, however big or small, help us provide access to trusted science information at a time when the world needs it most. Please support us by making a donation or purchasing a subscription today.