Assessing the Privacy of mHealth Apps for Self-Tracking: Heuristic Evaluation Approach.
Assessing the Privacy of mHealth Apps for Self-Tracking: Heuristic Evaluation Approach.
复制标题
DOI：
10.2196/mhealth.9217
复制
发表时间：
2018-10-22
影响因子：
5
通讯作者：
Nuseibeh B
中科院分区：
文献类型：
--
作者：
Hutton L;Price BA;Kelly R;McCormick C;Bandara AK;Hatzakis T;Meadows M;Nuseibeh B
最近自我跟踪技术的普及使个人能够生成有关其生活方式的大量数据。这些数据可用于支持卫生干预措施和监测结果。然而，这些数据通常由具有商业动机的供应商存储和处理，因此，它们可能不会像处理其他医疗数据那样敏感。随着能够自我跟踪的传感器和应用程序变得越来越复杂，隐私问题也变得越来越严重。然而，目前缺乏系统地识别此类应用程序中隐私问题的方法。我们研究的目的是了解当前大众市场应用程序在隐私方面的表现。我们通过引入一组用于评估自我跟踪服务的隐私特征的方法来做到这一点。使用我们的统计学，我们对64种流行的自我跟踪服务进行了分析，以确定这些服务在多大程度上满足了隐私的各个方面。然后，我们使用描述性统计和统计模型来探索应用程序的任何特定类别在隐私方面是否比其他类别表现更好。我们发现，大多数被调查的服务未能向用户提供对其自己数据的完全访问权限，没有获得用户对数据使用的充分同意，或者没有充分扩展对向第三方披露的控制。此外，就收集的数据类别而言，应用程序的类型并不是其隐私的有用预测因素。然而，我们发现，收集健康相关数据（例如，运动和体重）的应用程序在隐私方面的表现比其他类型的自我跟踪应用程序更差。我们的研究提请人们注意当前自我跟踪技术在隐私方面的糟糕表现，从而激发了对标准的需求，这些标准可以确保未来的自我跟踪应用程序在维护用户隐私方面更加强大。我们的启发式评估方法支持自我跟踪应用程序中隐私的回顾性评估，并可用作在未来应用程序中实现隐私设计的规定性框架。
The recent proliferation of self-tracking technologies has allowed individuals to generate significant quantities of data about their lifestyle. These data can be used to support health interventions and monitor outcomes. However, these data are often stored and processed by vendors who have commercial motivations, and thus, they may not be treated with the sensitivity with which other medical data are treated. As sensors and apps that enable self-tracking continue to become more sophisticated, the privacy implications become more severe in turn. However, methods for systematically identifying privacy issues in such apps are currently lacking. The objective of our study was to understand how current mass-market apps perform with respect to privacy. We did this by introducing a set of heuristics for evaluating privacy characteristics of self-tracking services. Using our heuristics, we conducted an analysis of 64 popular self-tracking services to determine the extent to which the services satisfy various dimensions of privacy. We then used descriptive statistics and statistical models to explore whether any particular categories of an app perform better than others in terms of privacy. We found that the majority of services examined failed to provide users with full access to their own data, did not acquire sufficient consent for the use of the data, or inadequately extended controls over disclosures to third parties. Furthermore, the type of app, in terms of the category of data collected, was not a useful predictor of its privacy. However, we found that apps that collected health-related data (eg, exercise and weight) performed worse for privacy than those designed for other types of self-tracking. Our study draws attention to the poor performance of current self-tracking technologies in terms of privacy, motivating the need for standards that can ensure that future self-tracking apps are stronger with respect to upholding users’ privacy. Our heuristic evaluation method supports the retrospective evaluation of privacy in self-tracking apps and can be used as a prescriptive framework to achieve privacy-by-design in future apps.
影响因子：
5
作者：
Dehling T;Gao F;Schneider S;Sunyaev A
通讯作者：
Sunyaev A
影响因子：
2.7
作者：
COHEN, J
通讯作者：
COHEN, J