| Designing for security and usability in mobile healthcare must be looked at holistically across an entire system implementation rather than focusing on one or two security layers. In addition to the security and privacy risk factors introduced in Sections 1.3 and 1.4, the literature has identified other factors underlying this challenge: system implementers treating security or usability as an add-on to a finished product (Yee 2004), and conflicts of interest existing between the system owner and its users (Kainda, Flechais et al. 2010). These factors should be taken into account when developing usable and secure systems. Several researchers have proposed frameworks to guide the design and development of secure and usable mobile health systems. Researchers developed and tested a framework to support policy enforcement on the security and privacy needs of health data, including the mechanisms required to support such policies on mHealth applications (Gardner, Garera et al. 2009; Ahmed and Ahamad 2012); proposed a security and usability threat model detailing the various factors pertinent to the security and usability of systems (Kainda, Flechais et al. 2010); and provided a way to incorporate a set of security and usability principles into existing and future security solutions (Josang, AlFayyadh et al. 2007). For a risk-sensitive system such as healthcare, mobile device and application security must be considered together. Common security attributes that should be present in these information-sensitive applications include: authentication, authorization, accountability, availability, confidentiality, integrity, device and user management, and physical security (Sathyan and Sadasivan 2010). While data security standards for HIPAA compliance have been discussed extensively, a lack of security standardization has been identified as a significant barrier to assuring privacy, interoperability, and achieving healthcare improvements from mHealth technologies (Luxton, Kayl et al. 2012). What is needed is a standardized framework to implement HIPAA standards and ensure they are enforced. This research aims to design, implement, and test security solutions across a continuum of security risks associated with: Collecting and transmitting patient data Sharing patient data with researchers to provide insights into patterns and clinical interventions. |
