  Mobile health applications (mHealth apps for short) are being increasingly
adopted in the healthcare sector, enabling stakeholders such as governments,
health units, medics, and patients, to utilize health services in a pervasive
manner. Despite having several known benefits, mHealth apps entail significant
security and privacy challenges that can lead to data breaches with serious
social, legal, and financial consequences. This research presents an empirical
investigation about security awareness of end-users of mHealth apps that are
available on major mobile platforms, including Android and iOS. We collaborated
with two mHealth providers in Saudi Arabia to survey 101 end-users,
investigating their security awareness about (i) existing and desired security
features, (ii) security related issues, and (iii) methods to improve security
knowledge. Findings indicate that majority of the end-users are aware of the
existing security features provided by the apps (e.g., restricted app
permissions); however, they desire usable security (e.g., biometric
authentication) and are concerned about privacy of their health information
(e.g., data anonymization). End-users suggested that protocols such as session
timeout or Two-factor authentication (2FA) positively impact security but
compromise usability of the app. Security-awareness via social media, peer
guidance, or training from app providers can increase end-users trust in
mHealth apps. This research investigates human-centric knowledge based on
empirical evidence and provides a set of guidelines to develop secure and
usable mHealth apps.
