JMIR Publications

ABSTRACT

Background:

Privacy has always been a concern, especially in the health domain. The proliferation of mHealth apps has led to a high amount of sensitive generated data. Some authors have performed privacy assessments in mHealth applications (mHealth apps). However, they have evaluated diverse privacy components and used different criteria.

Objective:

This scoping review aims to understand how privacy is assessed in mHealth apps, focusing on components, scales, criteria, and scoring methods used. A simple taxonomy to categorize mHealth apps privacy assessments based on the component being evaluated is also proposed.

Methods:

We followed the methodology defined by Arksey and O’Malley to conduct a scoping review. Included studies were categorized based on the privacy component, which was assessed using the proposed taxonomy.

Results:

The database searches retrieved a total of 710 citations; 24 of them met the defined selection criteria and data were extracted from them. Even though inclusion criteria considered articles since 2009, all the eventually included studies were published from 2014 onwards. Although some papers analyze only privacy, others also include security. Moreover, some of them analyze the full app, being privacy just part of the assessment. The evaluation criteria used by authors are heterogenous, based on their own experience, the literature and/or an existing legal framework. Regarding the set of items used in the assessments, each article has defined a different one. Most of the included studies provide a scoring method that allows comparing privacy in apps.

Conclusions:

The assessment of privacy in mHealth apps is a complex task, as the criteria that are used by different authors for the evaluation are very heterogeneous. Though some studies about privacy assessment have been conducted up to now, a very large set of items to evaluate privacy have been used. In-app information and privacy policies are mainly utilized by the scientific community to extract privacy information from mHealth apps. The creation of scales according to more objective criteria is a desirable step forward for privacy assessment in the future.