Collaborative Research: SaTC: CORE: Medium: Narrowing The Gap Between Privacy Expectations and Reality in Mobile Health

近年来，用于健康监测的移动应用程序急剧增加，COVID-19大流行加速了这一趋势。通过收集和利用大量数据，移动健康应用程序可以彻底改变人们监控自己健康状况的方式，以及他们与医生互动的方式。由于意外的数据使用和糟糕的隐私保护吓跑了潜在用户，这场革命可能会偏离轨道。本项目系统地考察了消费者在使用移动健康应用程序时的隐私期望、健康应用程序开发者的隐私观点和行为、法律和相关隐私政策提供的隐私保护以及此类应用程序的实际数据处理实践之间潜在的脱节。研究团队正在通过展示向开发人员和用户传达隐私信息的新方法来解决已识别的断开连接问题。该团队将通过制定政策建议、改进透明度和隐私控制机制的经过验证的用户界面工件、监测数据实践和执行隐私法规的实用解决方案，以及为开发人员提供在设计软件时考虑隐私的建议，试图更好地使移动健康应用程序的实践与消费者的隐私期望保持一致。结合社会科学、计算机安全和隐私、自然语言处理和法律方面的专业知识，调查人员正在全面分析移动健康应用程序的隐私。他们将通过研究他们的敏感资源使用和网络通信来学习应用程序的实际数据实践。调查人员正在研究当前的隐私法如何适用于健康应用程序，并将其与用户和开发人员的期望进行比较。对健康应用用户的研究将确定用户的隐私期望，并测试隐私界面的可用性。对健康应用程序开发者的研究将确定他们对隐私的看法，并测试促进隐私的开发工具。这些研究的结合将指出干预措施，并开发和测试实际的界面改进和开发工具。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Recent years have seen a dramatic rise in mobile apps for health monitoring, a trend accelerated by the COVID-19 pandemic. By collecting and utilizing massive amounts of data, mobile health apps could revolutionize how people monitor their health and how they interact with physicians. This revolution could be derailed by unexpected data uses and poor privacy protections scaring away potential users. This project systematically examines the potential disconnects between consumers’ privacy expectations when interacting with mobile health apps, privacy perspectives and behaviors of health apps’ developers, the privacy protections afforded by the law and relevant privacy policies, and the actual data handling practices of such apps. The research team is addressing identified disconnects by demonstrating new methods of communicating privacy information to developers and users. The team will attempt to better align the practices of mobile health apps with the privacy expectations of consumers by producing policy recommendations, validated user interface artifacts that improve transparency and privacy control mechanisms, practical solutions for monitoring data practices and enforcing privacy regulations, and advice for developers on considering privacy while designing software.Combining expertise in social sciences, computer security and privacy, natural language processing, and law, the investigators are comprehensively analyzing the privacy of mobile health apps. They will learn the app’s actual data practices by studying their sensitive resource usage and communication over the network. The investigators are examining how current privacy laws do and don’t apply to health apps, and comparing them with both users’ and developers’ expectations. Studies of health app users will identify users’ privacy expectations and test the usability of privacy interfaces. Studies of health app developers will identify their views on privacy and test privacy-promoting development tools. The combination of these studies will point to interventions, and develop and test practical interface improvements and development tools.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.