Towards the Uses of Blockchain in Mobile Health Services and Applications: A Survey <s> Discussion and Open Issues <s> Biometrics offers greater security and convenience than traditional methods of personal recognition. In some applications, biometrics can replace or supplement the existing technology. In others, it is the only viable approach. But how secure is biometrics? And what are the privacy implications?. <s> BIB001 </s> Towards the Uses of Blockchain in Mobile Health Services and Applications: A Survey <s> Discussion and Open Issues <s> The incremental adoption of electronic media in U.S. health care has created increased risk of security and privacy violations in provider organizations. Protective regulatory efforts have been proposed to address ineffective security of patient information, with severe noncompliance penalties. Using data from a nationwide survey of health information managers, this study examines how industry-wide knowledge management trends may influence the degree of security program adoption in health-care organizations. Results suggest that significant nonadoption of mandated security measures continues to occur across the health-care industry. Paper-based systems still prevail, and computerized settings tend to have less security measures. Implications for document management and knowledge policy are discussed. <s> BIB002 </s> Towards the Uses of Blockchain in Mobile Health Services and Applications: A Survey <s> Discussion and Open Issues <s> This is the second part of a two-part paper on the information theoretic study of biometric security systems. In this paper, the performance of reusable biometric security systems, in which the same biometric information is reused in multiple locations, is analyzed. The scenario in which the subsystems are jointly designed is first considered. An outer bound on the achievable trade-off between the privacy leakage of the biometric measurements and rates of keys generated at the subsystems is derived. A scheme that achieves the derived outer bound is then presented. Next, an incremental design approach is studied, in which the biometric measurements are reused while keeping the existing system intact. An achievable privacy-security trade-off region for this design approach is derived. It is shown that under certain conditions, the incremental design approach can achieve the performance of the joint design approach. Finally, examples are given to illustrate the results derived. <s> BIB003 </s> Towards the Uses of Blockchain in Mobile Health Services and Applications: A Survey <s> Discussion and Open Issues <s> This is the second part of a two-part paper on the information theoretic study of biometric security systems. In this paper, the performance of reusable biometric security systems, in which the same biometric information is reused in multiple locations, is analyzed. The scenario in which the subsystems are jointly designed is first considered. An outer bound on the achievable trade-off between the privacy leakage of the biometric measurements and rates of keys generated at the subsystems is derived. A scheme that achieves the derived outer bound is then presented. Next, an incremental design approach is studied, in which the biometric measurements are reused while keeping the existing system intact. An achievable privacy-security trade-off region for this design approach is derived. It is shown that under certain conditions, the incremental design approach can achieve the performance of the joint design approach. Finally, examples are given to illustrate the results derived. <s> BIB004 </s> Towards the Uses of Blockchain in Mobile Health Services and Applications: A Survey <s> Discussion and Open Issues <s> From the perspective of services to the population, with vast social implications, in which the security, confidentiality, and access to personal data represents a critical region, the medical services and information systems that are on the base of the strategic management in health care systems, are a theme of maximum interest and rather less approached. In particular, the prospect of at-home health care systems for screening and rehabilitation has raised enormous interest and is seen as a new method to approach the disease more efficaciously. With the development of Information Technology and its major breakthroughs in health care information systems, bringing the rehabilitation and monitoring of the elderly patients from in-hospital to more advanced at-home health care systems, information security measures has been raised. A survey of security measures and data communication security involved in health care systems in order to ensure information protection is presented in this paper. The specific security issues involved in the development of a health care system that manages data to support monitoring and rehabilitation of patients with Parkinson's disease is subject of this paper. <s> BIB005 </s> Towards the Uses of Blockchain in Mobile Health Services and Applications: A Survey <s> Discussion and Open Issues <s> Background: Mobile health (mHealth) apps show a growing importance for patients and health care professionals. Apps in this category are diverse. Some display important information (ie, drug interactions), whereas others help patients to keep track of their health. However, insufficient transport security can lead to confidentiality issues for patients and medical professionals, as well as safety issues regarding data integrity. mHealth apps should therefore deploy intensified vigilance to protect their data and integrity. This paper analyzes the state of security in mHealth apps. Objective: The objectives of this study were as follows: (1) identification of relevant transport issues in mHealth apps, (2) development of a platform for test purposes, and (3) recommendation of practices to mitigate them. Methods: Security characteristics relevant to the transport security of mHealth apps were assessed, presented, and discussed. These characteristics were used in the development of a prototypical platform facilitating streamlined tests of apps. For the tests, six lists of the 10 most downloaded free apps from three countries and two stores were selected. As some apps were part of these top 10 lists in more than one country, 53 unique apps were tested. Results: Out of the 53 apps tested from three European App Stores for Android and iOS, 21/53 (40%) showed critical results. All 21 apps failed to guarantee the integrity of data displayed. A total of 18 apps leaked private data or were observable in a way that compromised confidentiality between apps and their servers; 17 apps used unprotected connections; and two apps failed to validate certificates correctly. None of the apps tested utilized certificate pinning. Many apps employed analytics or ad providers, undermining user privacy. Conclusions: The tests show that many mHealth apps do not apply sufficient transport security measures. The most common security issue was the use of any kind of unprotected connection. Some apps used secure connections only for selected tasks, leaving all other traffic vulnerable. [JMIR Mhealth Uhealth 2017;5(10):e147] <s> BIB006 </s> Towards the Uses of Blockchain in Mobile Health Services and Applications: A Survey <s> Discussion and Open Issues <s> Abstract The Iraqi healthcare sector has been suffering from health records management issues from the perspectives of low information technology integrity and data complexity. As a solution, cloud computing services can offer an alternative, low-cost, and reliable way to store, manage, and retrieve health-related data, as well as monitoring patients’ health conditions anywhere and anytime using any device with any platform. The migration to cloud services is not yet widespread in Iraqi health facilities due to various challenges, including security and privacy, legal policies, and implementation. For instance, there has been no research shedding light on the utilization of cloud computing services in Iraqi hospitals’ health information systems. This study proposed a model by defining the critical success factors influencing physicians’ confirmation and behavioral control toward utilizing cloud health information systems in Iraqi hospitals. The model’s variables were statistically investigated by utilizing an online questionnaire. Data were collected from a probability sample of 259 physicians working in four Iraqi high-IT hospitals. The collected ordinal data were analyzed using the PLS-SEM approach as a nonparametric second-generation multivariate analysis. The results showed that the effects of system compatibility, system complexity, security, and privacy on physicians’ confirmation and behavioral control were statistically significant. Both confirmation and behavioral control had a positive effect on physicians’ utilization of the technology in the Iraqi hospitals. It is believed that such finding may help to aid the current understanding of cloud health systems in managing health data as well as providing the necessary recommendations for policy makers to direct healthcare professionals to continuously consider the use of modern information and communications technology in the workplace. <s> BIB007
With the current rate of evolution that the m-Health field is experiencing, it has become clear that its flexible, decentralized and personalized nature can be harnessed in order to complement some faults that a traditional health system usually possesses. These faults usually range from lack of accessibility and availability to overall service quality. M-Health allows the patient to have a better understanding of their condition without having to resort to physically attending a medical appointment, empowering patients to self-care and promoting their privacy. Furthermore, the constant monitoring that a m-Health solution has of the patient allows it to provide additional layers of depth to his health condition, increasing the information that the medical professionals have to work with. Moreover, this information is shared with the patient itself, increasing transparency towards the user. Although the adaptations mentioned previously into a traditional health system appear to offer several types of advantages, they also bring challenges that have to be faced in order for these solutions to be able to be integrated successfully. The integration process itself has it challenges, mainly regarding the method of how these new technologies are introduced into an already complex environment. This possibly resulting in regulation and organizational changes, infrastructure investment, staff training and informative sessions for patients. In addition, the technologies have to evolve and mature in order to increase both their capabilities, their security and their credibility. All of these characteristics are linked, as an increase in features poses new security challenges and these two factors directly affect the credibility of these solutions. In terms of impact, the security of health data assumes a key role in the process of above-mentioned adaptation. In a rapidly evolving environment such as m-Health, the practice of devising processes and mechanisms to secure new types of data in new storage requires research work and concept tests. The main challenges that recur from tackling the issues mentioned above are based on where the data is stored, how it is stored and how it can then be accessed BIB005 . Regarding where the data is stored, there are two main ways of storing e-health data: i) in a health service provider own local server or remote server; or ii) in the cloud. As mentioned previously, cloud storage solutions introduce major advantages compared to traditional storage solutions. But there is more to it than just the difference between information stored locally or in the cloud. There are a lot of new important details to consider when cloud storage systems are introduced, especially due to new complex factors that are added to an existing system. Some of these factors are the methods for a secure data storage and retrieval from the cloud BIB007 . When data is migrated into a cloud server, several aspects regarding the format and accessibility of the data, change. At first glance, the clear advantages of a cloud system seem to have no drawbacks or problems associated, as it enhances security and accessibility by allowing data to be stored remotely in a potentially more secure and always online and available site. This decreases security concerns related to the control of the physical server where the data is stored. Due to the data importance, guaranteeing that it is not altered and allowing a reliable access allows both health service providers and the user to have a saved and updated health history. In addition, changing this data with malicious intent can have a large impact on the results of diagnostics and possible treatments. Therefore, and because health data has value that is independent of time, the immutability of the past information that is stored must be assured. In regards to this, due to the nature of cloud services and their data recovery and fault tolerance, this issue can also be solved when introducing cloud storage BIB002 . However, after a more careful approach, the cloud solution also poses problems regarding the security, access control and even ownership of the data. First off, the data is no longer under direct control of the health service provider nor the user, which can lead to ownership problems, especially when the cloud provider policies are unclear or collaborative towards access to the data by third-parties, without direct permission from the user and owner. Therefore, there is a need for clear and privacy-first policies regarding stored data in cloud service providers servers. In order to avoid problems originated from inside leakage, whether it be from improper tampering with data storage or from leakage in operations made in the cloud service provider infrastructure. In addition, data transportation from cloud servers has to be secured by using procedures purposefully built to enhance the security of data transfers. Current studies BIB006 indicate that a large portion of m-Health applications still demonstrate issues such as compromised confidentiality and unprotected connections between applications and their servers. The access to the data itself presents various challenges, which can be consolidated into a situation where a user accesses his data from a cloud server. This situation presents two problematic issues, data access and retrieval from the cloud server. In order for the user to be able to access the data, he needs to do so from a device that can verify if the accessing user either owns the data or has permission to access it. This, however, requires security measures to be implemented in order to secure access to either the device or the application that requests the data. While implementation of biometric security seems to be an advantageous solution, it does not come without raising concerns regarding privacy issues that arise from the method of acquiring and storing biometric data, as well as other security related issues BIB003 , BIB004 , BIB001 . Otherwise, the process of data retrieval from the cloud server has to be implemented with special attention to access management and control. Due to the private nature of health data, only data owners or special users with access permissions, such as health service providers, may be able to have access to the data. The method in which controlled access to this data can be accomplished is with the use of encryption, identity verification, and access control systems. The patient who owns the data must give permission to thirdparties so they can access it and, to ensure that the patient is in full control of his own information, this permission would be equivalent to having a data decryption key. By having data access logs, it is then possible to audit these access and act accordingly for illegal situations  , empowering the data ownership of the patients. However, this situation becomes troublesome because logs can be manipulated and the access history can be tampered with or even lost, in the case of a local fault. This is an issue where blockchain implementations present effective solutions.