Trust in Mobile Health Applications

Abstract

As mobile devices become more prevalent in healthcare scenarios, it is becoming necessary to develop infrastructure to allow these devices to securely participate in emergency healthcare response scenarios. In this work, the scenario of an emergency response team requesting access to the health care records of a patient is analyzed. As these records may not be immediately available to the requesting party, several parties may need to be contacted to ensure to validate the identity of the requester and deliver the records. Existing works exploring this topic are briefly analyzed. Using recommendations found in these works as well as standard technologies such as SSL, X.509, and AES, a proposed protocol for such a scenario is presented. The construction of a prototype using Android as the mobile phone OS and Tomcat as the Java HTTP Servlet container and web server is discussed, focusing on the implementation decisions as well as the difficulties encountered during development. Finally, weaknesses of the proposed protocol that were realized during prototype implementation are discussed and future improvements are proposed.