Data classification for secure mobile health data collection systems

Data collected in Mobile Health Data Collections Systems (MHDCS) are diverse, both in terms of type and value. This calls for different data protection measures to meet security goals of confidentiality, integrity, and availability. The majority of commonly used open-source MHDCS track and monitor individuals over a while. It is therefore important to have sensitive data defined and proper security measures identified. We propose a data classification model as a basis for secure design and implementation. Our method combines interviews with case studies. The case studies focused on three of the widely used MHDCS platforms in low-resource settings; that is Muzima, Open Data Kit (ODK), and District Health Information Software (DHIS) 2 Tracker Capture. Interviews with domain experts helped define the sensitivity of data in MHDCS. The proposed data classification model provides for three sensitivity levels: public, confidential, and critical. The model uses context information and multiple parameters as inputs to a classification scheme that maps data to sensitivity levels. The generated data classifications are intended to guide developers and users to build security into MHDCS starting from the early stages of the software development life cycle.