What do we assess when we assess mHealth app privacy and security? A rapid scoping review of mHealth app privacy instruments.

Abstract

Objectives: While there are numerous mobile health (mHealth) apps on the market, previous research has highlighted their risks to privacy and security. Therefore, an instrument to assess the privacy and security of these apps may be helpful for ensuring consumers' data safety. We therefore conducted this rapid scoping review with the objective of surveying the landscape for instruments used to measure and quantify privacy and/or security of mHealth apps in the past 10 years.

Materials and methods: Following the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 guidelines, we systematically searched the relevant literature in 4 electronic databases between May 2015 and May 2025. The characteristics of the papers and/or instruments were analyzed and reported descriptively. The instruments' content was analyzed using content analysis.

Results: We identified 66 papers describing 42 distinct instruments. We found that the number of items and rating methods varied significantly across the instruments. Five topics were identified from content analysis: data practice, security measures, risk and incident management, regulatory compliance and users' rights, and privacy policy and terms and conditions.

Discussion: While the nature of the instruments is diverse, it is currently unknown how many items, which topics, or how responses should be structured is optimal. Additionally, the majority of identified instruments cannot comprehensively measure the proposed 5 topics. Moreover, questions on security measures may not be easily rated by users without specific domain knowledge.

Conclusion: This review can serve as a guide for future mHealth app privacy and security evaluation.