Towards a contextual theory of Mobile Health Data Protection (MHDP): A realist perspective

Highlights

• We report on a realist review of Mobile Health Data Protection (MHDP).

• The review identifies contexts, mechanisms and outcomes of MHDP failure and success.

• MHDP failure and success impact patients’ mHealth adoption, use and satisfaction.

• Our contextualized MHDP theory informs effective mHealth interventions in practice.

Abstract

Background

With the introduction of privacy regulations such as the California Consumer Privacy Act and the European Union General Data Protection Regulation (GDPR), effective data protection in mobile health (mHealth) is rapidly becoming a concern. However, we have a limited understanding of the contexts and mechanisms that affect the likelihood of failures and successes in mHealth data protection, and their subsequent impacts. In this review and theory development paper, we aim to address this critical knowledge gap.

Method

We conducted a systematic literature search using PubMed, Embase, and Scopus databases. To synthesize the evidence, we adopted a realist review approach and compiled the extracted information based on context-mechanism-outcome (CMO) configurations. Out of an initial set of 611 records, 19 articles met the eligibility criteria and were included.

Results

Our findings indicate that the failures and successes in data protection and their impacts (effective mHealth interventions, data protection awareness, and adoption/use of mHealth systems) depend contingently upon a number of contextual factors (systems, users, tasks, services, geographic elements) and causal mechanisms (unauthorized access, device theft, loss, and sharing, lack of cyber-hygiene, and data protection concerns for failures, and trust building activity, secure and law compliant platforms, and perceived data protection, for successes). We conceptualized the CMO configurations to provide explanations for the reported failures and successes in data protection.

Conclusion

For effective mHealth interventions, the dark side of system use (data breaches) must be mitigated and remediated. Our study offers a theoretical model that contextually explains how the mechanisms of success and failures work in mHealth.

Introduction

In the digital health era, traditional models of care delivery have been transformed thanks to information technology-enabled services and business models [[1], [2], [3]]. A prominent ecosystem for effective care delivery is mobile health (mHealth) [4,5]. Internet-connected mHealth devices provide ubiquitous access to care providers to obtain personal health data. Meanwhile, patients can easily share their health information and receive health advice [6]. However, adoption and effective use of mHealth is tempered by data protection concerns [7,8]. From the perspective of both patients and providers, failures in the protection of personal health data are highly controversial and consequential [2,9]. This concern also is reflected in the World Health Organization (WHO) reports on mHealth and digital intervention, which highlighted calls for actions, policy and legal attention to ensure effective data protection [10,11].

Researchers have also documented several cases in mHealth context where mobile app developers are not transparent about data protection and also introduce intentional or by-product risks to effective data protection [12]. Furthermore, technical assessments of mHealth apps have revealed that several supposedly secure apps in healthcare did not adequately protect patient data. For example, a recent study on data sharing of top-rated mHealth apps in four developed countries found that the majority of the included apps for analysis shared personal data with third parties, ranging from birthday and email to medical conditions, and symptoms [13]. A similar study on 79 certified clinical apps showed security vulnerabilities and breaches such as sending sensitive information without encryption and authorized access to user data [14].

Effective data protection in mHealth is a technical and social phenomenon. Apart from technical elements such as a system’s privacy and security safeguards, social elements such as patients’ trust and clinicians’ practices in using the system play important roles in mHealth data protection failure and success [[15], [16], [17]]. As evident in our literature review, there is a paucity of theories that address the context-specific social and technical aspects of mHealth data protection. To advance the knowledge in this highly important context and embarking on the realist review approach, we aim to provide a theoretical model of failures and successes in mHealth data protection that is grounded in emerging evidence. By applying this approach, we sought to answer the following overarching research questions:

• In what circumstances (contexts and mechanisms) is mHealth data protection most likely to be failed or successful?

• What are the potential outcomes of mHealth data protection failures or successes?

Answering these questions can enhance our understanding of health data protection and more importantly facilitates theorizing the phenomena of mHealth data protection. Thereby, we move toward theorizing the phenomena by unpacking the context-mechanism-outcome (CMO) relationships and explaining the impacts of mHealth data protection failures and successes.

The rest of this paper is organized as follows: First, we describe our methodological approach in conducting the realist review. Next, we demonstrate our results in two sections: study characteristics and main findings, followed by a discussion of the mechanisms and outcome in the mHealth context. Finally, the conclusions are presented.