Clinical software on personal mobile devices needs regulation

The regulation of clinical software for personal mobile devices (PMDs) has increased in relevance for physician practice.1 The plausible benefits of using software such as iStethoscope, Flipboard, Skype or MedCalc on smartphones and tablets include up-to-date access to health data, support for distributed health care and improved quality of interactions with patients. Recent World Health Organization survey findings confirm that use of PMDs by clinicians offers tangible patient care benefits including the integration of mobile health into existing services regardless of geography, connection to an electrical grid and income level. And yet, the legal vacuum in guidelines governing smartphone and tablet use is a key implementation barrier in upper-middle income regions such as Europe (reported by 56% of countries) and the Americas (50%).2 Increasingly, governments overseas are at least thinking about, if not acting upon, this challenge — but Australian governments remain silent.

Software on computers and portable memory, such as USB sticks, share several security risks associated with software on a PMD that are not addressed by legislation. These include transmission of user log-ons and address-book details, message interception and activity tracking. Professional self-regulation has begun to fill legislative gaps but does not guide the clinical use of PMDs.

One security risk related to PMDs concerns “root-kits” — software applications that are hidden by manufacturers to monitor program performance or installed by attackers for malicious purposes. Unknown to the person using a PMD, root-kits can log keystrokes and user locations and can receive messages without notification. They often transmit data in unprotected cleartext, too.

Another danger concerns the mix of more than 600 000 software applications, both personal and professional, that people, including physicians, install on mobile devices. Almost 70% of American doctors have downloaded and installed 1500 types of clinical software applications, and Australian physicians are close behind.1 Some clinical software does not actually offer the benefits that are advertised, or is difficult to use. The level of use is alarming because the terms of use of the installed software on PMDs can alter protective device settings, threatening the reliability, and so security, of medical information read on these. In the absence of regulatory guidelines, physicians and health organisations need to be cautious about their use of this software, which, when linked to error, may lead to medicolegal consequences.

The gaps in regulation haven’t resulted in Australian litigation yet. This is due to factors that include the legal requirement for patients to show they have suffered a direct material cost as a consequence of a data breach. However, the legislative landscape is changing. Current United States health security research findings suggest mobile device activity is of particular legislative concern.3 We can either regulate clinical software now or wait and let the courts decide, when legal cases occur.

Many physicians are confused by the way PMDs have blurred the boundaries of their responsibilities in the context of new and emerging clinical software.2 Australian Therapeutic Goods Administration (TGA) regulations are limited to controlling the intended purpose, labelling and advertising claims of clinical software. Assistive technologies on mobile devices, such as software supporting individuals to ameliorate societal barriers, are regulated by the Australian Communications and Media Authority (ACMA) for community use.4 Current regulation is fragmented and siloed, and legal guidelines do not cover the assumptions physicians make about the use of software on PMDs.

Health authorities refer the matter of using software on PMDs for patient care to other government agencies, who in turn advise that such decisions should be deferred to local health organisations.5 This ongoing deferral of responsibility forces local health organisations to make strategic decisions about authorising clinical software on mobile devices for physicians in the absence of pertinent regulatory guidelines.

Legal uncertainty undermines the confidence with which health organisations and physicians authorise or use PMDs. Physician and organisational confidence in using PMD software for their work, especially diagnosis, would benefit from bringing the TGA and ACMA together with professional organisations to list, evaluate and classify the software. Australian governments urgently need to support physician confidence in new, emerging and useful technologies to achieve the care benefits found in the WHO survey rather than wait for the results of litigation.