Form‐based security in mobile health data collection systems

• Published in: Security and privacy 2021-05, Vol.4 (3), p.n/a
• Main Authors: Katarahweire, Marriette, Bainomugisha, Engineer, Mughal, Khalid A., Ngubiri, John
• Format: Article
• Language: English
• Subjects: data classification; data sensitivity; mobile data collection; mobile health; secure design; STRIDE; threat modeling
• ISSN: 2475-6725; 2475-6725
• DOI: 10.1002/spy2.155

Mobile Health Data Collection Systems (MHDCS) use electronic forms for data collection in place of paper surveys. Data is entered into the electronic forms by community health workers with smartphones. These systems are used in clinical trials and continuous monitoring of participants. Data collected in MHDCS is diverse with varying sensitivity levels. This therefore calls for the application of different security mechanisms to protect the data. In this paper, a data sensitivity classification model is proposed. It determines the sensitivity levels of form attributes depending on the context and sensitive parameters. The electronic form is the starting point of the data collection process. We augment the form with sensitivity levels and a mapping of security mechanisms to the sensitivity levels is made. Through threat modeling, we identify potential threats and possible mitigations. We demonstrate the feasibility of our approach by prototyping the proposed model into the Open Data Kit tool suite. Tests show that the security mitigations specified during form design are executed once the secure form is loaded on the mobile device during data collection. Our ultimate aim is to facilitate the addition of security requirements into the data collection processes right from the start of the design process.