To assist in resolving ethical questions surrounding unregulated mHealth research, we conducted in-depth qualitative interviews with experts from four key stakeholder groups: patient/research advocates, researchers, regulatory professionals, and mobile app/device developers. They discussed challenges and potential solutions in the context of two hypothetical scenarios involving unregulated mHealth research, including notifications/permissions for research use of mHealth data, data access procedures, new primary data collection, offering individual research results, and data sharing and dissemination.

A key feature of unregulated mHealth research is the diversity of participants in this space. Applying an approach drawn from user experience design, we describe a set of archetypal unregulated mHealth researcher “personas,” which range from individuals who seek empowerment or have philanthropic objectives to those who are primarily motivated by financial gain or have misanthropic objectives. These descriptions are useful for evaluating policies applicable to mHealth to understand how they will impact various stakeholders.

Behavioral scientists are developing new methods and frameworks that leverage mobile health technologies to optimize individual level behavior change. Pervasive sensors and mobile apps allow researchers to passively observe human behaviors “in the wild” 24/7 which supports delivery of personalized interventions in the real-world environment. This is all possible because these technologies contain an incredible array of sensors that allow applications to constantly record user location and can contextualize current environmental conditions through barometers, thermometers, and ambient light sensors and can also capture audio and video of the user and their surroundings through multiple integrated high-definition cameras and microphones. These tools are a game changer in behavioral health research and, not surprisingly, introduce new ethical, regulatory/legal and social implications described in this article.

Using mobile health (mHealth) research as an extended example, this article provides an overview of when the Common Rule “applies” to a variety of activities, what might be meant when one says that the Common Rule does or does not “apply,” the extent to which these different meanings of “apply” matter, and, when the Common Rule does apply (however that term is defined), how it applies.

The individual right of access to one’s own data is a crucial privacy protection long recognized in U.S. federal privacy laws. Mobile health devices and research software used in citizen science often fall outside the HIPAA Privacy Rule, leaving participants without HIPAA’s right of access to one’s own data. Absent state laws requiring access, the law of contract, as reflected in end-user agreements and terms of service, governs individuals’ ability to find out how much data is being stored and how it might be shared with third parties. Efforts to address this problem by establishing norms of individual access to data from mobile health research unfortunately can run afoul of the FDA’s investigational device exemption requirements.

This article assesses the protections provided by state research laws for participants in mobile application (mobile app) mediated health research conducted by independent scientists, citizen scientists, and patient researchers. Prior scholarship in this area focuses on the lack of application of: (1) federal regulations governing research conducted or funded by one of sixteen signatory federal departments and agencies (the Common Rule); and (2) separate federal regulations promulgated by the Food and Drug Administration applicable to research conducted in anticipation of a submission to the FDA for approval of a drug or medical device. This article builds on this prior scholarship by carefully examining state research laws and suggesting ways in which these laws could be improved to better protect participants of mobile appmediated research conducted by independent scientists, citizen scientists, and patient researchers.

This article focuses on state privacy, security, and data breach regulation of mobile-app mediated health research, concentrating in particular on research studies conducted or participated in by independent scientists, citizen scientists, and patient researchers. Prior scholarship addressing these issues tends to focus on the lack of application of the HIPAA Privacy and Security Rules and other sources of federal regulation. One article, however, mentions state law as a possible source of privacy and security protections for individuals in the particular context of mobile app-mediated health research. This Article builds on this prior scholarship by: (1) assessing state data protection statutes that are potentially applicable to mobile app-mediated health researchers; and (2) suggesting statutory amendments that could better protect the privacy and security of mobile health research data. As discussed in more detail below, all fifty states and the District of Columbia have potentially applicable data breach notification statutes that require the notification of data subjects of certain informational breaches in certain contexts. In addition, more than two-thirds of jurisdictions have potentially applicable data security statutes and almost one-third of jurisdictions have potentially applicable data privacy statutes. Because all jurisdictions have data breach notification statutes, these statutes will be assessed first.

This article addresses the data protection and product safety regulatory models currently applied to consumer-facing health technologies. It explains how the design and structures of existing data protection and safety regulation in the U.S. have resulted in exceptionally thin protection for the users of consumer-facing devices and products that rely on or that facilitate consumer collection or aggregation of health and wellness data. It also examines some appealing legislative alternatives to the current thin model used in the U.S. and suggests a framework for prioritizing ameliorative regulation. To better understand existing regulatory models, their deficiencies, and how they should be reformed, the article employs an analytical model describing these regulatory systems across two axes. The vertical axis describes the quantity or depth of regulation, such as, for example, the strictness of the rules imposed by the regulatory model. The horizontal axis describes the reach of the regulation, the behaviors, products, or industries to which the regulation applies.

The Federal Trade Commission (FTC) has an important role to play in the governmental oversight of mobile health apps, ensuring consumer protections from unfair and deceptive trade practices and curtailing anti-competitive methods. The FTC’s consumer protection structure and authority is outlined before reviewing the recent FTC enforcement activities taken on behalf of consumers and against developers of mhealth apps. The article concludes with identification of some challenges for the FTC and modest recommendations for strengthening the consumer protections it provides.

mHealth devices and applications, with their wide accessibility and ease of use, have the potential to address persistent inequities in biomedical research participation. Yet, while mHealth technologies may facilitate more inclusive research participation, negative features of some unregulated use in research — misleading enrollment practices, the promotion of secondary mHealth applications, discriminatory profiling, and poorer quality feedback due to dependencies on biased data and algorithms — may threaten the trust and engagement of underrepresented individuals and communities. To maximize the participation of currently disenfranchised groups, those involved in unregulated mHealth research must become aware of potential risks, adopt targeted education policies, audit algorithms for hidden biases, and engage citizen scientists and other community members to identify and forestall possible harms.

Biomedical research using data from participants’ mobile devices borrows heavily from the ethos of the “citizen science” movement, by delegating data collection and transmission to its volunteer subjects. This engagement gives volunteers the opportunity to feel like partners in the research and retain a reassuring sense of control over their participation. These virtues, in turn, give both grass-roots citizen science initiatives and institutionally sponsored mHealth studies appealing features to flag in recruiting participants from the public. But while grass-roots citizen science projects are often community-based, mHealth research ultimately depends on the individuals who own and use mobile devices. This inflects the ethos of mHealth research towards a celebration of individual autonomy and empowerment, at the expense of its implications for the communities or groups to which its individual participants belong. But the prospects of group harms — and benefits — from mHealth research are as vivid as they are in other forms of data-intensive “precision health” research, and will be important to consider in the design of any studies using this approach.

This article provides practical guidance for researchers who wish to enroll and collect data from pediatric research participants through online and mobile platforms, with a focus on the involvement of both children and their parents in the decision to participate.

In qualitative interviews with a diverse group of experts, the vast majority believed unregulated researchers should seek out independent oversight. Reasons included the need for objectivity, protecting app users from research risks, and consistency in standards for the ethical conduct of research. Concerns included burdening minimal risk research and limitations in current systems of oversight. Literature and analysis supports the use of IRBs even when not required by regulations, and the need for evidence-based improvements in IRB processes.

The article covers electronic informed consent (eIC) from different dimensions so that practitioners might understand the history, regulation, and current status of eIC. It covers the transition of informed consent to electronic screens and the implications of that transition in terms of design, costs, and data analysis. The article explores the limits of regulation mandating eIC for mobile application research, and addresses some of the broader social context around eIC.

This article examines the privacy and security issues associated with mobile application-mediated health research, concentrating in particular on research conducted or participated in by independent scientists, citizen scientists, and patient researchers. Building on other articles in this issue that examine state research laws and state data protection laws as possible sources of privacy and security protections for mobile research participants, this article focuses on the lack of application of federal standards to mobile application-mediated health research. As discussed in more detail below, the voluminous and diverse data collected by some independent scientists who use mobile applications to conduct health research may be at risk for unregulated privacy and security breaches, leading to dignitary, psychological, and economic harms for which participants have few legally enforceable rights or remedies under current federal law. Federal lawmakers may wish to consider enacting new legislation that would require otherwise unregulated health data holders to implement reasonable data privacy, security, and breach notification measures.

Participant-driven research (PDR) is a burgeoning domain of research innovation, often facilitated by mobile technologies (mHealth). Return of results and data are common hallmarks, grounded in transparency and data democracy. PDR has much to teach traditional research about these practices and successful engagement. Recommendations calling for new state laws governing research with mHealth modalities common in PDR and federal creation of review mechanisms, threaten to stifle valuable participant-driven innovation, including in return of results.

As citizen science expands, questions arise regarding the applicability of norms and policies created in the context of conventional science. This article focuses on data sharing in the conduct of health-related citizen science, asking whether citizen scientists have obligations to share data and publish findings on par with the obligations of professional scientists. We conclude that there are good reasons for supporting citizen scientists in sharing data and publishing findings, and we applaud recent efforts to facilitate data sharing. At the same time, we believe it is problematic to treat data sharing and publication as ethical requirements for citizen scientists, especially where there is the potential for burden and harm without compensating benefit.

In this paper, we outline the policy implications of mobile health research conducted at the international level. We describe the manner in which such research may have an international dimension and argue that it is not likely to be excluded from conventionally applicable international regulatory tools. We suggest that closer policy attention is needed for this rapidly proliferating approach to health research.