Mobile health technology has great potential to increase healthcare quality, expand access to services, reduce costs, and improve personal wellness and public health. However, mHealth also raises significant privacy and security challenges. ith the advent of miniaturized sensors, low-power body-area wireless networks, and pervasive smartphones, the burgeoning field of mobile health (mHealth) technology has attracted tremendous commercial activity, consumer interest, and adoption by major healthcare providers. This technology has great potential to increase healthcare quality, expand access to services, reduce costs, and improve personal wellness and public health. These benefits will only be achieved, however, if individuals are confident in the privacy of their health-related information and if providers are confident in the security and integrity of the data collected. The US spends more than $2.6 trillion annually on healthcare. This amount represents approximately 18 percent of the country's gross domestic product, a percentage that has doubled over the past 30 years and is the highest of any nation in the world. 1 Over 75 percent of these costs are due to the management of chronic diseases, which currently affect 45 percent of the US population. By 2023, the annual costs to manage chronic diseases alone are expected to rise to $4.2 trillion. 2 Similar challenges occur in many developed nations with an aging citizenry, and in developing nations that strive to provide better healthcare to their growing populations. Numerous countries look to IT-increasingly, to mobile technology like smartphones and wearable sensors-to address these problems. However, health IT faces broad software assurance challenges, 3 and overcoming these will be critical to adopting mHealth systems and realizing their benefits. Privacy and security were cited as the most important concerns in a recent survey of 27 "key informants" from across the US healthcare and mHealth sectors. 4 Furthermore, a year- These trends are driving major changes in the health IT landscape, and require research to develop effective security technologies that work across care settings and support continuous data collection in the context of multipurpose mobile devices. Before exploring the challenges in detail, we first define our scope. Traditional approaches to securing healthcare systems have relied on isolation, using tools like firewalls and network access control. However, the trends MOBILE HEALTH: DEFINITION AND CATEGORIES I n this article, mobile health, or mHealth, refers to the use of mobile technologies-wearable, implantable, environmental, or portable-by individuals who monitor or manage their own health, perhaps with the assistance of individual caregivers or provider organizations. The technology might support clinical care-including diagnosis and disease management-or wellness goals such as losing weight, eating a healthy diet, quitting smoking, or becoming physically fit. Our definition of mHealth includes four general categories: » Physiological monitoring: measuring, recording, and reporting physiological parameters such as heart rate and blood pressure. » Activity and behavior monitoring: measuring, recording, and reporting movement and physical and social activity as well as health-related behaviors such as eating and addictive behaviors. » Information access: accessing health-related data-for example, medical records, activity, or behavior data-and decision-support tools. » Telemedicine: communication between patients and caregivers and/or providers-for example, a virtual doctor visit or a patient receiving personal encouragement from a caregiver support team. described above make it unfeasible to simply "lock down" medical devices or health-records systems, especially because patients and staff use part of the system outside the clinical context and many of the wellness applications of this technology are entirely nonclinical. Instead, these trends demand "wide-spectrum" security technologies that can be adjusted to fit the system user's needs and expertise. A major healthcare provider has professional staff that can configure and monitor security settings in its electronic medical record (EMR) database, but an individual patient must have intuitive and hassle-free security technologies for home-based devices. Given this scope-mHealth technology used by individuals who might be supported by caregivers and providers, perhaps remotely-we can specify numerous open research challenges that span technology, policy, and organizational domains. Most mHealth systems collect data about a person's physiology, physical activity, or social behavior and are designed to store the data for later analysis by caregivers and providers. Data sharing raises the question of consent: how and when does the person decide whether, and with whom, to share what data and at what level of granularity? In the traditional health information management model, patients consent to the collection and use of their personal health information (PHI) for treatment purposes. Further consent is often sought for additional PHI uses, such as research. mHealth systems, however, often collect a far broader range of information, much more continuously and for a wider range of uses than is collected in traditional clinical settings. Research is needed to help individuals understand what data is being collected, where it is stored, who has access to which data at what granularity, and what it will be used for. Indeed, individuals should be given personal preferences regarding PHI collection, dissemination, and retention. Regulations such as HIPAA (the Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health) in the US provide some guidance but do not apply to much of the personal wellness domain, and leave wide latitude for creative abstractions and interfaces that would allow people to make informed choices about their PHI. Research challenge: how can an mHealth system expose to its users, in an understandable way, what data is being collected, what information is being shared with whom, what might be inferred by that information, and where and how the information might be used, and then notify users of any deviations from the agreed-upon protocol? User consent or policy determines who can access mHealth data, but how do mHealth systems confidently identify the individual(s) they are sensing or who is using the system? Identification is critical to attach the correct identity to the mHealth data for provenance, and authentication is the foundation of access control and audit logging. Many of today's mHealth apps are based on a smartphone, leveraging its sensors and user interface to collect, process, and report healthrelated information about the device's owner. As smartphones are designed as personal devices, it is normally safe to assume that the user is indeed the owner. Of course, a smartphone can be stolen or borrowed by another person, resulting in the phone's mHealth apps recording data about the wrong person to the owner's health record or exposing the owner's PHI via app displays and notifications. It is thus important for a smartphone to know when it is not in the owner's possession. Most work on this problem focuses on initial authentication to unlock the user interface (most commonly via numeric codes, swipe patterns, or fingerprints), but there is a real need for continuous authentication-that is, repeatedly verifying that the phone's holder is the person who initially authenticated. Many future mHealth apps will use wearable devices to measure activity, behavior, and physiology and even to directly influence the body. Such devices must be able to verify the wearer's identity to ensure that the collected data is posted to the correct health record and that any treatment applied is truly intended for the wearer. One solution is to build biometric sensing into the device, such as the bioimpedance approach taken by Cory Cornelius and his colleagues. Furthermore, any method for identifying and authenticating smartphone or wearable device users for mHealth apps must be accurate, applicable to most persons, robust to environmental conditions, unobtrusive, and resistant to various attacks.  Much of the information-whether physiological, behavioral, or socialcollected by mHealth systems is sensitive and highly personal. The data must remain confidential, subject to access-control policies and mechanisms, and anonymous when used for research and public-health purposes where individual identities are not necessary. Mobile-sensor data provides researchers with unprecedented opportunities to quantify the complex temporal dynamics of key physical, biological, behavioral, psychological, social, and environmental factors that contribute to disease. For example, GPS data makes it possible to collect geo-exposures (such as proximity to a tobacco point of sale for a newly abstinent smoker or to a fast-food restaurant for a congestive heart-failure patient) and movement patterns (such as driving or physical activity), and to study their impact on health. However, mobile-sensor data can also disclose private information about the user. For example, GPS data can reveal not only the user's identity but also all the places the user has visited, some of which might be private. Even if GPS is turned off, data collected by the accelerometers and gyroscopes embedded in smartphones and smartwatches for activity monitoring could be used to characterize a person's movement patterns. Sharing raw mobile-sensor data thus carries re-identification risks. Sharing only high-level inferencesfor example, begin/end times at home or work-from the data might limit such risks but also significantly limits the data's utility.  Measurements from mobile devices and wearable sensors can provide unique visibility into a user's health status, stress, addictive behavior, eating patterns, sedentary behavior, geo-exposures, and daily social interactions. Such data can help researchers better understand the etiology of complex human diseases responsible for more than half of all US deaths. However, sharing this data also poses new privacy challenges. For example, audio data can reveal conversational and emotional characteristics, exposure to TV programming and advertisements, and video game playing and other activities, but it can also capture private and intimate details. There is a need for technologies that mitigate the risks of behavioral privacy disclosure while also supporting the health or wellness goals for which the data is collected. For example, realtime audio processing could be used to extract relevant health inferences while discarding sensitive content but would necessitate improved algorithms. Likewise, breathing patterns could be used to infer conversation episodes 10 but would require wearing respiration sensors and would not capture either conversational content or speakers' identities.  A key benefit of mHealth sensors is that the same sensor can be used to infer various behaviors. For example, electrocardiography can be used to monitor cardiovascular health, but ECG can also be used to infer stress level and the use of some drugs, such  Many mHealth benefits will be delivered to users, caregivers, and providers through smartphone apps. These apps might › use the phone's sensors to record sounds, take photos, or record motion; › communicate with other sensor devices worn on the skin or collect health-related information from nearby sensors that, for example, sense contaminants in the air; or
Kotz et al. focus on the privacy and security challenges of mHealth technology REF .
Privacy and Security in Mobile Health: A Research Agenda
Computer
Computer
Medicine Computer Science