The nude photos stolen from Jennifer Lawrence, Kate Upton, and other female celebrities could spell trouble for Apple’s forthcoming health-care app. It wouldn’t be a stretch for those following news of the leaked photos to worry about trusting their iPhones with intimate health data.
Apple (AAPL) has already acknowledged that “certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions” while denying “any breach in any of Apple’s systems.” But that carefully worded defense may not reassure those nervous users busy taking their own private pictures off iCloud, Apple’s online storage program.
Apple’s new app, HealthKit, is expected to combine data from activity trackers and medical records in one place. The company is expected to discuss the program and associated tools with developers at a high-profile event on Sept. 9. The idea is to let other app developers tap into health data, with permission from the iPhone user. “You can allow the data from your blood pressure app to be automatically shared with your doctor. Or allow your nutrition app to tell your fitness apps how many calories you consume each day,” promises a preview of HealthKit on Apple’s website.
One of the challenges for HealthKit developers trying to link mobile phones to medical records is making sure people are who they say they are. “How does a patient tell you this is his or her account, so that what you are actually going to pull is his or her information?” asks Girish Navani, chief executive of eClinicalWorks, a health IT company. The company plans to connect its Healow app, which has 25 million users, with HealthKit. The program already lets patients tap into their medical records, connect to fitness trackers, and book appointments with participating medical offices. Navani says the app won’t load clinical data until patients have appeared for office visits to verify their identities.
Apple has already told HealthKit developers that health information can’t be sold to marketers or other data brokers, although with users’ permission it may be shared for research purposes. Apple has also said that HealthKit apps can’t rely on storing data in iCloud, according developer guidelines reported by ZDNet.
That may sound like an implicit admission that iCloud isn’t secure, but the truth is more nuanced. Software secure enough for everyday business and personal communications doesn’t always meet the U.S. legal standard for health-care companies handling sensitive medical data. And making developers store information outside of iCloud potentially shields Apple from liability for any breach.
Medical providers must abide by privacy rules spelled out in the Health Insurance Portability and Accountability Act, a 1996 law known as HIPAA. “Those are very stringent standards that have to be adhered to, and platforms have to show that they do adhere to them,” says Jonathan Collins, a mobile health analyst at ABI Research.
HIPAA is the reason your doctor can’t e-mail medical records to a specialist. It’s why a lot of health information, such as diagnostic scans, travels by secure fax (often, but not always, paperless). The law has spawned an entire industry recreating HIPAA-compliant versions of such common consumer programs as online chats, text messaging, and e-mail.
Apple’s HealthKit is expected to mingle data that must be handled in accordance with HIPAA with more mundane information, such as how many steps you took yesterday and what you ate for breakfast. How much users trust Apple and iOS developers will play a huge role in determining how willing they are to share sensitive health-care information. “I would certainly expect them to stress the security side of it,” Collins says of Apple’s upcoming HealthKit debut. “It will clearly have to be addressed, but I don’t believe it will be a major brake on adoption.” Jennifer Lawrence and company may think otherwise.
(Bloomberg Businessweek)
