cMHAFF Project

Overview

The Consumer Mobile Health Application Functional Framework, (CMHAFF) defines security, privacy, and data standards and guidelines for mobile health applications ( health apps). CMHAFF guidelines also addresses aspects of transparency and consumer protection through the development life-cycle of such apps (from purchase, download, installation, use, and deletion). The intent is to provide industry guidance and common methods to enable the development of mobile health apps targeted to consumers/citizens that use protected health information (PHI) and personally identifiable information (PII).

These standards will not address the clinical content of such apps (e.g., "Does it give good advice?"), but will provide a framework for security, privacy, and the integration of data generated from apps into Personal Health Record (PHR) and Electronic Health Record (EHR) systems, as well as into other types of data repositories (e.g., personal data stores, population care systems). Health Apps reference applications running typically on smartphones, but also on other consumer devices such as watches, fitness devices and tablets.

CMHAFF may reuse conformance criteria already available within the HL7 PHR-S and EHR-S Functional Models, augmenting with new conformance criteria specific to mobile platforms (e.g., use of geolocation services, accelerometers, cameras, microphones, contacts). It will also use existing HL7 principles for privacy and security risk assessment. CMHAFF responds to the universal domain with U.S. national and international participation in its development. It will not attempt to replicate standards, regulations, and guidelines defined elsewhere, but will reference them wherever possible.

In particular, CMHAFF will address the following areas:

• Transparency of information about the app,
• An apps purpose, intended use, target audience, authors, sources, evidence, etc.
• User, device, and cross-system authentication
• Authorization to content and features
• Proxy designations
• Use of location services, camera, accelerometers and other smartphone services
• Security of data at rest (local and cloud)
• Security of data in transit (wired and wireless)
• Minimum data standards for device generated and device transmitted information
• Record system reliability; record authenticity (it is what it represents to be)
• Data provenance
• Audit
• Discontinuation of use of an app
• Conditions and agreements, e.g., privacy policy, terms of use, and in-app disclaimers