A search was conducted across PubMed, ScienceDirect, ResearchGate, and Sematic Scholar databases, focusing on the past fifteen years from 2007 to 2023. This timeframe was chosen to ensure recent literature representation while allowing for the observation of how issues have evolved over time with technological advancements. Limiting the search to five or ten years is deemed excessively restrictive, as it would overlook this historical development of these issues.

Relevant search terms such as mobile devices, patient privacy, confidentiality breaches, data security, data protection, regulatory compliance, user consent, data encryption, third-party integration, and user awareness were utilized to encompass the subject comprehensively. The use of Boolean operations like OR and AND facilitated the broadest possible retrieval of relevant articles. Articles were then categorized into common problems and proposed solutions.

We opted to review a total of eighty-eight articles sourced from diverse geographical locations across various countries because, we view health information as a fundamental requirement for all individuals and acknowledge the global significance on privacy and confidentiality with use of mHealth apps ( Table 1 ). Incorporating studies from various countries was deemed suitable to pinpoint both shared patterns and disparities, thus offering a comprehensive overview of the literature concerning this subject.

Mobile health (mHealth) applications have revolutionized the interaction between physicians and patients [12] . Instances of data breaches are increasingly common and cause greater financial harm to numerous businesses [13] by involving significant disclosure of sensitive data to external organizations, causing subsequent actions like inquiries, rectifications, and legal costs [14] .

Starting from 2005, the frequency of data breaches has increased by over three times, largely due to technological advancements and the dissemination of information [15] . Concerns about data privacy were a recent concept for both developers and users [16] , also, technological advancements in Mobile cloud computing and cloud-based Electronic Health Records (EHRs) have provided remedies for the security of devices and maintained data secrecy to a certain extent [17] .

A privacy framework outlines fundamental principles, methodologies, and solutions for safeguarding individuals’ personal information and privacy, and therefore setting up an appropriate framework for mHealth is required to promote patient trust [18] [19] . A significant role in the liaison of mHealth apps is played by transport security and the possibility of a data breach happens while reading data via a proxy server, from which the application takes data and displays it for patients [20] . Under the data protection laws of the United Kingdom, data collected from a mobile health app is considered sensitive personal information which provides details about their health system and for the same reason it is essential to maintain data security on mobile devices and when it is transferred to a storage facility [21] . Because of the large volume of users’ sensitive health data and to safeguard the privacy of its citizens, governments have developed frameworks [16] .

[22] mentioned that having a framework serves as a foundation and key element for information security in mHealth systems. Various efforts were made to form security frameworks in the past, yet none have had essential functions of security, ethics, and availability [21] . The scan conducted by [23] unveiled many weaknesses within the 15 medical android applications of which, a significant portion could have been averted by better coding practices and secure engineering; also, he puts forward the idea that the responsibility is on the developer to remain updated about current security protocols and standards.

mHealth security frameworks effectiveness was assessed by [24] who found that security frameworks can be incorporated into any health app seamlessly to reduce security and privacy risks without compromising the user experience and the effects of using security frameworks were remarkable regarding security and privacy. Combining mHealth with blockchain technology provided an effective solution to ensure the easiness of accessing data and transparency [25] [26] . The global regulatory framework influenced by the General Data Protection Regulation (GDPR) defines data concerning the individual granting additional rights to users, to object, process, and erase [27] .

[28] refers security as a condition to protect patients’ health information from unauthorized use and privacy means the absence of unapproved trespasses. Intrusions can happen locally as well as remotely [29] and one of the security features available to block remote intrusions, is multifactor authentication [30] - [32] . In the study conducted by [33] , nineteen independent mobile personal health records (mPHR) were assessed with emphasis on the significance of data security, data import and export capabilities, image uploading and the opinion to generate a summary of health data found that, security and data privacy as significant concerns where the authors suggest having an additional layer of security using app-level passwords.

Devices with personal information must have suitable security measures to secure the data from fraud attacks [34] . Most health applications use a Single Factor Authentication (SFA) technique where, access to mHealth apps is protected by a password whereas, it has many limitations [35] [36] . Typically, users save their login details for apps on their mobile devices, making it simple for attackers to gain unauthorized access to sensitive data [21] . Even though the SFA method is more user-friendly, Two Factor Authentication (2FA) introduces additional elements to secure access to personal information [37] . 2FA, three-factor verification comprising Biometric Authentication and Grid-based Authentication approaches are the solutions introduced recently in the field of mHealth, to overcome the limitations of SFA [36] - [38] .

Due to the seamless connectivity and the built-in sensors available in smart devices, it has been an advantage to extract biometric details needed to implement user authentication for mHealth apps [39] [40] . Utilizing the device authentication mechanism to confirm identity helped to prevent any unauthorized participation of devices and enhanced securing the privacy and confidentiality of personal information [41] .

Authentication for health apps based on password were susceptible to data breach and even alternate solutions of using biometric data and One-Time Password (OTP) for authentication also remained vulnerable to cyber-attacks [36] . For storing information securely and transferring without risks, Cryptography along with authentication serves as an effective solution, and the fundamental keys of cryptographic methods are encryption—responsible for converting data to an unintelligible form from its original state, and the decryption process—managing restoration of original data at the recipient’s end by utilizing a confidential key [26] [42] . Information collected from an app must be encrypted from end-to-end to block unapproved access during the storage and transfer of data [34] [43] [44] in their comparative analysis, found encryption and decryption ensure the security of data even if a mobile phone with the mHealth app is robbed because theft of encrypted personal health data is challenging.

Numerous mHealth applications that lack utilizing encryption standards [45] , which are considered at high risk for causing a significant threat to the privacy of patients’ data, at the same time, those applications with encryption protocols have a very low risk for cyber-attacks [20] [46] .

Conventional password-based authentication and encryption methods are not sufficient for ensuring the security of healthcare data [47] . One of the most popular Password-based encryption (PBE) methods becomes vulnerable to cyber threats when users choose weak and easily predictable passwords making it easy for an attacker to decrypt if provided with encrypted plain text [48] . This issue is tackled with the use of Honey Encryption (HE) in which the encrypted plain text when decrypted with an invalid key reveals a valid yet false message, making it a challenge for the attacker to determine, if decryption was successful [48] [49] .

One of the crucial and necessary functions to be employed by an app developer, for data gathering, storing, and transferring health information, is data encryption [49] [50] .

The privacy of a health application can be assessed by its privacy policy which gives details about the control, generation, processing, transfers, and storage of data; as well as acknowledgment of potential risks related to gathering data and users’ rights, including the ability to cancel the consent [16] [51] . Recent studies reveal, a lack of privacy policy in frequently used mHealth apps due to the neglect of many developers [52] - [55] . It is even found that, at times, the privacy policy is not complete or exhaustingly large to read causing adverse outcomes of data breaches [54] [56] . In the same manner, health applications were lacking consumer consent, because there was no privacy policy, or the provided text was too lengthy for the users to understand [27] . On one hand, privacy policies do not give importance to the app by not providing enough information to end-users, and on the other hand, consumers are inclined to use apps with privacy policies that are not clear to them [57] .

The focus of the designers for privacy policy should be on enhancing clarity by making it simple and emphasizing transparency which will make the privacy policy an effective one, and accordingly, it can lessen users’ anxiety regarding privacy, boost their confidence, and improve their understanding of the advantages of utilizing health applications [51] . It must be explicitly mentioned in the policy if the data is shared for advertising purposes, and emphasis must be on its accessibility, whether in the app itself or the app store, and the users must be adequately informed about the ways the data is handled [58] . Similarly, the study done by [53] found the necessity to have details in the privacy policy, on the ways to report grievances regarding the app’s privacy techniques. It is recommended in the study done by [52] that, before recommending a health app to the user, clinicians must assess its privacy policy for crucial details such as data encryption, safeguarding with passwords, and the capability to modify or erase details entered into the application.

To monitor and document the ongoing status or actions of the condition of a patient, certain mobile applications utilize the internet with the assistance of built-in sensors and this practice may pose a potential security risk [59] . The study done by [60] , found that most of the health apps are allowed to connect to the internet and are permitted to show advertisements; meanwhile, a few of them utilize it for transferring users’ data via the internet. Data theft caused by unsecured connections can be managed by verifying user credentials and by making use of Transport Layer Security (TLS) or Secure Socket Layer (SSL) for safe connection on the internet [59] [60] . Furthermore, [60] suggests an in-depth review of external services for storing the users’ sensitive data, and users must be notified when involving third-party, even if the network is secure and encrypted.

There are two terms to be considered while discussing data ownership and they are, data owner—an individual or a person who generates health data referred to as a patient and, data consumer—a person, to whom the data owner wishes to exchange the personal health information with [61] . Granting patients complete control of their digital data ensures authentic ownership, privacy, and openness which will establish trust with patients using health applications [62] . Yet, [63] mentioned that it is difficult to determine the ownership of health data because the developers who made this advancement in the health sector also take part in the collection and usability of data. For patients to switch healthcare providers or to reassess their information and to even withdraw data access; “owner-driven access” for the patients enables them to decide on handling their data [61] .

To distribute health information from data controllers to consumers, it is necessary to store the data in a database, and each information entered into the database is called a “record” [61] . Due to the vulnerability of information gathered through mHealth apps, it is a risk to store the data locally; even the traditional storage method of cloud computing had to face incidents of a breach in security [63] - [66] . Some of the challenges in the cloud computing model are also related to storage sites and creating backups of essential data as a precaution during data loss [64] . Remedies proposed for solving challenges in cloud computing involve saving health information as blocks of data without keeping an identity tag of the person who owns data, encrypting the data during collection, storage, and transmission [66] [67] , finding the location of storage, modifying app features by evaluating usability and trustworthiness, and using the updated standards of interoperability [64] .

Extensively large amount of available mHealth applications poses considerable challenges for the users who lack awareness about the management and utilization of personal health information data [68] [69] . To understand how patients utilize technologies in the personal health record framework, [70] used Technology Acceptance Model (TAM) and found three main factors affected the usage: “Perceived Ease of Use (PEOU)”—utilization requires no extra effort of user, “Perceived Usefulness (PU)”—technology can offer advantages compared to existing methods [71] , and the tendency to use the app by its security. Most people use mHealth services when it is suggested by social friends or at times, due to the wide use of apps by everyone [43] [72] , and most of the time, users are less worried about the confidentiality of their health data [11] [73] . The majority of the users of mHealth apps believed that applications from famous brands can be trusted when compared to others; on the other hand, people with knowledge of technology recommended features of encryption and participants with no IT knowledge highlighted the importance of ensuring the need of masking the identity of the individual in the users’ group [43] [68] [74] mentioned that clinicians must evaluate the compatibility of the chosen technology and advise the use only to those who need it because it is crucial to employ the correct technology for the needed one at the right moment. Even though the use of good standards of security features protects the privacy of users, it is equally important to improve the awareness about security among people using health apps; so that the features are utilized effectively to safeguard their personal data [55] [68] .

Intrusions that happen locally are privacy breaches done by people around a user; by inquiring about personal matters, unauthorized use of personal devices, or examining browsing history on their personal gadget [75] . To reduce these concerns and to motivate the use of mHealth apps, one strategy to incorporate is password protection and authentication [38] .

When using public Wi-Fi connections with doubtful security or skeptical about the involvement of third-party, it is suggested that utilization of Hypertext Transfer Protocol Secure (HTTPS) and Virtual Private Network (VPN) enable encryption and secure communication enhancing the data privacy and confidentiality [34] .

A user-friendly privacy safeguard integrated into mHealth applications is the use of generic names for the app because, some of the health applications choose to have their name pointed towards the disorder, which makes it easy for the people to figure out the kind of disorder the user is having; in such cases, as a security measure, users positioned these apps in a different folder with uncommon name [38] .

Even though mHealth applications are governed by regulations, like General Data Protection (GDPR) in European nations and Health Insurance Probability and Accountability (HIPPA) in the United States, more than half of the free mHealth app users are not informed about the data processing, which is necessary as per the regulatory guidelines, in one of the studies done by [76] . Similarly, many mHealth apps don’t follow the law regulations making them vulnerable to privacy and security breaches [60] [64] . The study by [77] mentioned that regulations for data security and privacy of health apps could delay their usage within the medical field and it is confusing to differentiate between legal regulations needed for clinical apps and behavioral apps. However, the health sector specifically has become the prime target of data breaches due to the sensitive details given to medical records; including names, addresses, and even social security numbers [78] [79] .

Even though individual nations maintain their separate frameworks for the protection and handling of sensitive health information, key aspects of consent, de-identification, and individual rights are commonly shared among countries in the West [80] ; but existing regulations in developing countries do not cover digital health or have a sufficient law about data protection [81] . The main loophole is that regulations like HIPAA and GDPR aim to protect privacy with a focus on healthcare institutions and there has been limited attention given to the construction of secure mHealth apps with appropriate guidance [82] [83] .

To accomplish the goals of protecting the privacy of patient data, GDPR ensured the implementation of adequate measures of the right to information, penalties from organizations and compensations to data owners for non-compliance, need for authorization for data handling, instant notification in case of a data breach, and clearly stated consent from users for collecting, storing, and transferring sensitive information [34] [84] - [86] . Furthermore, to overcome the challenges, it is advised to conduct regular external audits to assess the health app’s compliance with policies and law regulations and update the laws specifically about data security due to the continuous expansion of technology used by the mobile health app industry [31] [87] . Applications that are non-compliant with the federal regulations’ basic privacy requirements are barred from being deployed for the public and enable companies to rectify errors so that the applications are more secure [87] .

Business partners developing the mHealth app for healthcare entities must adhere to the guidelines outlined by HIPPA such as administrative, technological, and safeguard measures to protect electronic health data [44] . In addition, patients should receive detailed information regarding privacy protocols in mHealth apps and the privacy hazards of using health apps before installing and utilizing them [88] . HIPAA regulations strongly recommend using informed consent from users, if personal data is required for research studies or for advertisement purposes; and in most cases, users are given the right to limit or refuse the utilization of their personal information regarding health, which to some extent help to protect privacy and confidentiality [80] .