## 4 Results and Comparative Analysis
### Interpretation and Real-World Implications  
The disclosed vulnerabilities related to the PHGL-COVID ecosystem, albeit in a test environment, indicate systemic vulnerabilities noted on many authentic healthcare platforms. In the post pandemic world, mHealth has established itself as the operational backbone of continuous patient monitoring. Each layer exposed from wearable to containerized backend represents not only a technical vulnerability but also a potential source of clinical disruption, legal exposure and patient harm. First, the BLE breaches identified in the Galaxy Watch 7 demonstrate a common conflict between usability and security. By leaving the physiological characteristics available through unauthenticated reads (ex. heart rate and energy expenditure) the device allows passive eavesdropping or behavioral profiling, especially dangerous in shared environments like hospitals, elder care facilities or fitness clinics. Many adversaries do not require root access or malware to extract identifiable data from a no-device/low-device proximity attack, making wearable communications a high-risk, low-friction attack vector [60; 61; 62]. On the mobile layer, the persistent access tokens and permissive configuration of firmware layers have more alarming implications. In many contexts smartphones are the de facto identity anchor enabling access to health records, digital prescriptions or remote care's, giving a compromised device with impersonation authority access to long-term data exfiltration. The BYOD healthcare model or public-private telemedicine platform deployed in environments without an administrator provides no recourse or recovery options. The server-side vulnerabilities, introducing charting edginess from exposed legacy services and updated container images, indicates a larger issue. The transition to microservices and DevOps pipelines in healthcare IT is driven more by efficiency than by security. In this instance, there were over 20 critical CVEs identified in base images running essential services. These are not theoretical vulnerabilities, only those are well documented remotely exploitable conditions with proof-of-concept code available; therefore, the risk of remote code execution denial of service is real and concerning [63; 64]. Most concerning is the compound risk introduced by the interactions noted between devices. A benign BLE leak can cause erroneous inserted payloads on the smartphone, which could include command injection upon a backend API if it was improperly containerized. This horizontal to vertical command regime is rarely contemplated in mHealth security frameworks, since they seem to treat each type of device or instance as a silo, despite being interdependent chain instances. Outside of the technical realm, this discloser is serious regulatory and reputational issues. Operating the platform within the European Union or under regulations such as the General Data Protection Regulation (GDPR) or the Health Insurance Portability and Accountability Act (HIPAA) requires proper handling of biometric data and session access. Failure to do so may result in fines and legal action. In terms of governance, platforms like PHGL-COVID must provide not only availability and known reliable data but a security context across all device types and protocols involved. Finally, these findings challenge whether consumer-grade hardware can be safely utilized for medical-grade operations without modification. Whereas wearables and smart phones provide convenience of access, their use in regulated contexts requires a security approach that includes hardening, policy control and continuous auditing before these devices become the weakest link for an otherwise secure environment [22; 46; 65].