A Framework for mHealth App Security and Privacy Analysis

移动医疗应用程序安全和隐私分析框架

• 批准号: 10760047
• 负责人: Sheikh Iqbal Ahamed
• 金额: $ 78.88万
• 依托单位: UBITRIX INTERNATIONAL, INC.
• 依托单位国家: 美国
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-09-15 至 2025-08-31
• 项目状态: 未结题
• 来源: https://reporter.nih.gov/project-details/10760047
• 关键词: Address; Algorithms; Android; Apple; Appointments and Schedules; Area; Awareness; Behavior; Businesses; Cellular Phone; Code; Collaborations; Computer software; Data; Data Security; Dedications; Development; Devices; Effectiveness; Environment; Evaluation; FDA approved; Guidelines; Health; Health Insurance Portability and Accountability Act; Health Personnel; Health protection; Healthcare; International; Java; Knowledge; Language; Link; Marketing; Medical; Medical History; Medical Records; Methods; Mobile Health Application; Monitor; Names; Online Systems; Outcome; Patients; Performance; Phase; Play; Plug-in; Policies; Privacy; Privatization; Probability; Production; Programming Languages; Protocols documentation; Provider; Pythons; Regulation; Reproduction; Research; Research Personnel; Risk; Sample Size; Secure; Security; Side; Small Business Technology Transfer Research; Source Code; Techniques; Testing; United States Centers for Medicare and Medicaid Services; Universities; Vendor; computerized data processing; data communication; data exchange; data interoperability; data sharing; electronic health record system; encryption; evaluation/testing; handheld mobile device; health data; improved; mHealth; mobile application; non-compliance; prevent; prototype; remote health care; seal; sensor; smartphone application; success; supply chain; support tools; tool; transmission process; virtual; web based interface; web site

PROJECT SUMMARY/ABSTRACT With the increased use of mobile health (mHealth) apps to improve health outcomes, protecting private health data is becoming increasingly important. These mHealth apps are offered by healthcare providers and used by patients for various reasons such as paying bills, scheduling appointments, sending messages to providers, accessing lab results, and viewing prescriptions and medical records. With patients’ increasing desire for data accessibility and app data sharing, it is critical to ensure that patients transmit their Protected Health Information (PHI) to apps that comply with HIPAA privacy and security regulations. Unfortunately, about 25% of healthcare providers suffer from data breaches violating HIPAA policies caused by using mobile devices that come with mHealth apps. These breaches result in lawsuits and loss of confidence among health providers and patients. Earlier research has focused on mobile device security but has not checked further how apps store or transfer data securely before being used by remote healthcare providers or users. A total of 303,867 complaints have been received in the HHS.gov until July 2022 [95], which indicates that most developers, including mHealth apps developers, are unaware of HIPAA security and privacy regulations. This creates the market opportunity to develop static and dynamic code analysis tools for mHealth app developers, so their developed products meet HIPAA security and privacy guidelines. Currently, there is a lack of an analysis framework to check mHealth apps’ security and privacy risks following the applicable HIPAA technical security and privacy guidelines. We have developed a framework to analyze mHealth apps for HIPAA security and privacy compliance for Android. The tool is available both as a web-based interface for users without knowledge of HIPAA or app security and as a plugin with Android Studio to enable health app developers to test source code for potential data security breaches related to HIPAA before posting to the marketplace. In addition, the tool addresses API level checking for secure data communication mandated by recent Centers for Medicare & Medicaid Services (CMS) guidelines between third-party mobile health apps and EHR systems. The analysis framework also addresses heterogeneous health data and enables providers to comply with HIPAA administrative and operational guidelines. We have performed two acceptance tests on the prototype based on partnering with HIPAA experts, medical doctors, and for-profit EHR vendors along with the effectiveness of tools for detecting health data security breaches. In Phase II, we propose a commercial product mSPAiOS as a mHealth HIPAA checker by extending the framework for iOS mHealth apps security and privacy assessment, plugin support for xCode environment, and performance evaluation of the product by at least 3 for-profit organizations/EHR vendors. The proposed tool has the potential to capture the market of the HIPAA-compliant assessment as a unique product that is not provided by any existing tools.

项目概要/摘要 随着越来越多地使用移动健康 (mHealth) 应用程序来改善健康结果， 这些移动医疗应用程序由以下机构提供：私人健康数据变得越来越重要。 医疗保健提供者和患者出于各种原因使用，例如支付账单、安排时间 预约、向提供者发送消息、访问实验室结果以及查看处方 随着患者对数据可访问性和应用程序数据共享的需求不断增加， 确保患者将受保护的健康信息 (PHI) 传输到应用程序至关重要 不幸的是，大约 25% 的医疗保健行业遵守 HIPAA 隐私和安全法规。 提供商因使用移动设备而遭受违反 HIPAA 政策的数据泄露 这些违规行为会导致诉讼和健康界失去信心。 早期的研究重点关注移动设备安全，但并未涉及。 在远程医疗保健使用应用程序之前，进一步检查应用程序如何安全地存储或传输数据 截至 7 月，HHS.gov 共收到 303,867 起投诉。 2022 [95]，这表明大多数开发者，包括移动医疗应用程序开发者，都没有意识到 HIPAA 安全和隐私法规的出台创造了开发静态的市场机会。 为移动医疗应用程序开发人员提供动态代码分析工具，使他们开发的产品满足 目前，HIPAA 安全和隐私指南缺乏分析框架。 按照适用的 HIPAA 技术安全检查 mHealth 应用程序的安全和隐私风险 我们开发了一个框架来分析 HIPAA 的移动医疗应用程序。 Android 的安全和隐私合规性该工具可作为基于 Web 的界面使用。 对于不了解 HIPAA 或应用安全性的用户，并作为 Android Studio 的插件 使健康应用程序开发人员能够测试与以下相关的潜在数据安全漏洞的源代码 此外，该工具还可以在发布到市场之前进行 API 级别检查。 最近的医疗保险和医疗补助服务中心强制要求安全数据通信 第三方移动健康应用程序和 EHR 系统之间的 (CMS) 指南。 框架还解决异构健康数据并使提供商能够遵守 我们对 HIPAA 管理和操作指南进行了两次验收测试。 该原型基于与 HIPAA 专家、医生和营利性 EHR 的合作 供应商以及检测健康数据安全漏洞的工具的有效性。 II，我们提出了一个商业产品 mSPAiOS 作为 mHealth HIPAA 检查器，通过扩展 iOS mHealth 应用安全和隐私评估框架，xCode 插件支持 至少 3 个营利性组织/EHR 对产品的环境和性能进行评估 所提议的工具有可能占领符合 HIPAA 的市场。 评估作为一种独特的产品，任何现有工具都无法提供。