Health app industry self-policing and ‘trusted sourcing’ credibility at stake?

Updated below. Last week, after Happtique announced its ‘Inaugural Class’ of 19 certified apps [TTA 2 Dec]–certified on their standards of operability, privacy, security and content–a young HIT software developer, Harold Smith III, discovered some major security flaws in two of them: MyNetDiary’s Diabetes Tracker and TactioHealth5. User names and passwords were stored in plain text files–not encrypted–and Mr. Smith then subjected them to a ‘man in the middle attack’ (MITM) which he explains as “…where a nefarious source intercepts your communication from the App to the server. They decrypt the SSL connection, pull out your data, and send the data on to the server.” Both failed. Worse, the ePHI (ePersonal Health Information) of both were not sent in a secured way and not stored in secure, encrypted files. After advising both companies of the problems (including one of these companies in person at the mHealth Summit), as well as Happtique, and receiving no satisfactory response after days passed, Mr. Smith went public Tuesday and Wednesday on his blog mHealth and Mobile Development. Both articles deserve careful reading. Our readers with software development background will appreciate 1) his meticulousness and 2) his ire not only at Happtique but their validator, Intertek, at the poor technical quality of their vetting; the non-techies like your Editor will appreciate the clarity of his writing.

Small blog, big impact today. Happtique has suspended its certification program (website notice) and on its website now has revised certification standards. Regarding the credibility of Mr. Smith, (more…)