Data sharing by popular health apps is 'routine,' research finds

Mobile health apps are a booming market targeted at both patients and health professionals. Medicines-related apps help patients track their prescriptions and remember to take their pills. They also provide drug information to help clinicians prescribe and administer medications.

However these apps also pose unprecedented risk to consumers' privacy given their ability to collect user data, including sensitive information that is highly valuable to commercial interests, new research demonstrates.

Published in BMJ, the research team - from the University of Sydney, the University of Toronto and University of California - set out to investigate if and how user data is shared by top rated medicines-related mobile apps. It also sought to characterise privacy risks to app users, both clinicians and consumers.

The researchers found sharing of user data by medicines-related apps is routine but far from transparent, and also identified a small number of commercial entities with the ability to aggregate and potentially re-identify user data.

"Privacy regulators should consider that loss of privacy is not a fair cost for the use of digital health services," said lead author Assistant Professor Quinn Grundy of the University of Toronto and University of Sydney School of Pharmacy, Charles Perkins Centre.

How data is shared

The research team identified 24 top rated medicines related apps for the Android mobile platform in the United Kingdom, United States, Canada, and Australia. All apps were available to the public; provided information about medicines dispensing, administration, prescribing, or use; and were interactive.

They then ran laboratory-based traffic analysis of each app downloaded onto a smartphone, simulating real world use with four dummy scripts.

Privacy leaks were detected using a technique called Differential Traffic Analysis, explained co-author Dr Ralph Holz from the University of Sydney's School of Computer Science.

"The idea is to capture a baseline of the normal network data that an app causes, and then change privacy-related settings in the app. The places where the new settings turn up in any fresh network data shows us where and to whom the app is leaking it."

Of the sampled apps, most - 19 out of 24 or 79 percent - shared user data outside of the app. A total of 55 unique entities, owned by 46 parent companies, received or processed this data, including developers, parent companies (first parties) and service providers (third parties).

Third parties also advertised the ability to share user data with 216 'fourth parties' including multinational technology companies, digital advertising companies, telecommunications corporations, and a consumer credit reporting agency. Only three of these fourth parties could be characterised predominantly as belonging to the health sector.

Several companies, including Alphabet, Facebook, and Oracle, occupied central positions within the network with the ability to aggregate and re-identify user data.

Call for greater regulation and transparency

While it's unclear if iOS apps share user data - and if medicines-related apps share user data more or less than other health apps, or apps in general - the findings remain of concern said Assistant Professor Grundy.

"Most health apps fail to provide privacy assurances or transparency around data sharing practices," she said.

"User data collected from apps providing medicines information or support may also be particularly attractive to cybercriminals or commercial data brokers.

"Health professionals need to be aware of privacy risks in their own use of apps and, when recommending apps, explain the potential for loss of privacy as part of informed consent.

"Regulators should also emphasise the accountabilities of those who control and process user data, while health app developers should disclose all data sharing practices and allow users to choose precisely what data are shared and where."

Quinn Grundy, Kellia Chiu, Fabian Held, Andrea Continella, Lisa Bero, Ralph Holz.
Data sharing practices of medicines related apps and the mobile ecosystem: traffic, content, and network analysis.
BMJ 2019; 364 doi: 10.1136/bmj.l920.

Most Popular Now

Novartis announces plan to initiate clinical trial…

Novartis today announced plans to initiate a Phase III clinical trial to study canakinumab in patients with COVID-19 pneumonia. The CAN-COVID trial will examine the effic...

Gilead announces results from Phase 3 trial of inv…

Gilead Sciences, Inc. (Nasdaq: GILD) announced topline results from the open-label, Phase 3 SIMPLE trial evaluating 5-day and 10-day dosing durations of the investigation...

AstraZeneca and Oxford University announce landmar…

AstraZeneca and the University of Oxford announced an agreement for the global development and distribution of the University’s potential recombinant adenovirus vaccine a...

Sanofi and Regeneron provide update on U.S. Phase …

Sanofi and Regeneron Pharmaceuticals, Inc. (NASDAQ: REGN) today announced the preliminary results from the Phase 2 portion of an ongoing Phase 2/3 trial evaluating Kevzar...

Roche's COVID-19 antibody test receives FDA Emerge…

Roche (SIX: RO, ROG; OTCQX: RHHBY) announced that the U.S. Food and Drug Administration (FDA) has issued an Emergency Use Authorization (EUA) (1) for its new Elecsys® Ant...

Pfizer and BioNTech dose first participants in the…

Pfizer Inc. (NYSE: PFE) and BioNTech SE (Nasdaq: BNTX) announced that the first participants have been dosed in the U.S. in the Phase 1/2 clinical trial for the BNT162 va...

Arthritis drug may improve respiratory function in…

A small study in Greece found that the clinically approved anti-inflammatory drug anakinra, used to treat rheumatoid arthritis, improved respiratory function in patients ...

Early indicators of vaccine efficacy

Ludwig-Maximilians-Universität (LMU) in Munich researchers have shown that a specific class of immune cells in the blood induced by vaccination is an earlier indicator of...

Frankfurt researchers discover potential targets f…

A team of biochemists and virologists at Goethe University and the Frankfurt University Hospital were able to observe how human cells change upon infection with SARS-CoV-...

Vitamin D linked to low virus death rate

A new study has found an association between low average levels of vitamin D and high numbers of COVID-19 cases and mortality rates across 20 European countries. The r...

Loss of smell associated with milder clinical cour…

Following an earlier study that validated the loss of smell and taste as indicators of SARS-CoV-2 infection, researchers at UC San Diego Health report in newly published ...

Johnson & Johnson announces collaboration to e…

Johnson & Johnson (the Company) (NYSE: JNJ) announced a collaboration between the Janssen Pharmaceutical Companies of Johnson & Johnson and Emergent BioSolutions, Inc. to...