When you are sick, everyone wants your data. Advances in mobile computing are helping to create systems that gather detailed data from patients in real-life settings, and convey it to clinicians for individualized care. This trove of data can also be used to inform research, to assist government with evidence-based decision making, or for insurers, or perhaps advertisers, for business purposes. The implications for privacy are considerable.

The authors build a conceptual privacy framework for this model based on ten principles derived from a review of the many existing frameworks. Turning to privacy technology, the paper systematically reviews threats ranging from compromising identity, through access control and data integrity, to the loss of devices. It becomes challenging to select established security measures, such as encryption, to respond to these threats, especially in mobile computing, where power is limited. The paper identifies other open research questions. By far the most striking of these questions relates to the challenge of faithfully conveying the effects of access control decisions to lay people, and obtaining informed patient consent to the disclosure of data. Other major questions include privacy at the mobile node, enforcement of controls, data identity, anonymization, and accountability, and the trade-offs between these various issues.

This thorough and informative paper provides a guide to privacy for researchers and practitioners in healthcare informatics.