1. The Empowered Patient Persona

The empowered patient is a person living with a condition or disease who uses mHealth tools or devices to inform their choices about their care or enable self-directed management of their condition. The empowered patient may hack existing medical devices, develop novel devices, use existing devices for novel applications, or collect data from mHealth devices to design or execute self-interventions. These behaviors may arise due to frustration related to the patient’s options for care for their disease or condition or the perceived or real lack of attention by the medical or research enterprise to the symptoms or issues of greatest importance to them. Their frustration may be related to the perceived or real lack of attention by the medical or research enterprise to the symptom of greatest importance to them. They may be discouraged by the seemingly “glacial pace” of medical research, or the rate of translation of research findings to clinical care.¹⁹ The empowered patient may attempt to circumvent regulations or closed systems that thwart access to their own data or information about treatment or options.

Dana Lewis^{Reference Rao and Cunnane20} is an example of the empowered patient persona. Ms. Lewis, who is living with Type 1 diabetes, became frustrated with the crude systems available to her to monitor and control her blood sugar levels. Through self-taught, unregulated mHealth hacking, Ms. Lewis developed a reciprocal communication loop, enhanced with predictive algorithms, between her glucose monitor and insulin pump, creating a system that functions as an artificial pancreas.

Though the empowered patient attempts to better their own care, they might not understand the risks of activities that they undertake or they might be (too) willing to accept unreasonable risks. The empowered patient might overestimate their skills or knowledge.

It is important to note that the empowered patient may, intentionally or unintentionally, create a network effect with other empowered patients. It is difficult to estimate the prevalence of this evolution given that those who create such networks may naturally become more widely known. Though Ms. Lewis undertook unregulated mHealth research with herself as both researcher and participant, her work has grown into OpenAPS,²¹ a network of people living with Type 1 diabetes implementing the same (or similar) artificial pancreas hack, among other activities. Additional considerations for policy makers may arise as empowered patients share their unregulated mHealth research activities with others.

2. The Concerned Caregiver Persona

Concerned caregivers engage directly in unregulated mHealth research or seek to influence the research ecosystem to benefit the care of a loved one, such as a child, parent, or spouse. Like empowered patients, concerned caregivers may be frustrated by the perceived pace of innovation or discovery for their loved one’s condition.²² They may develop novel mHealth devices, use existing devices for novel application, or collect data from devices to design or execute interventions for their loved one. Through their actions, caregivers might experience feelings of agency or empowerment²³ that mitigate the myriad negative emotions frequently associated with having a loved one with or at risk of a health condition.

Two examples of concerned caregivers are John Costik and Dan Webster. Mr. Costik²⁴ developed a system to remotely monitor his diabetic son’s continuous glucose monitor, streaming low blood sugar alerts in real time through the cloud first to Mr. Costik’s phone and eventually to his smartwatch. Dr. Webster,²⁵ out of frustration from the absence of a systematic way to track the changes in his wife’s moles and her associated risk for melanoma, developed the ResarchKit²⁶ app MoleMapper.²⁷ Using the app, the couple were able to map and document her moles over time, providing supplemental data for regular dermatologist visits. In both cases, the development and use of an mHealth tool allowed the concerned caregiver more frequent, even continuous, monitoring of the loved one’s condition, facilitating potentially more effective and empowered caregiving.

The concerned caregiver arrives in the unregulated mHealth space altruistically. While they would never knowingly put a loved one in harm’s way, the relational dynamics between the caregiver and loved one may raise concerns about voluntariness and consent. This dynamic may be particularly fraught between a parent (or primary caregiver) and child (or other vulnerable class of participant), already a difficult relationship to govern in the regulated research context. The concerned caregiver may overestimate their knowledge as a researcher or be so excited by the promise of self-initiated solutions that they may not see clearly the risks involved, or may be too willing to accept such risks on behalf of another.

Finally, as with empowered patients, concerned caregivers’ actions may lead to community activism, either by nucleating a community of fellow caregivers/empowered patients or through the open sharing of a caregiver-developed tool, approach, or knowhow for broader use. As with empowered patients, it is difficult to estimate the prevalence of this evolution given that those caregivers who do make this leap may naturally become more widely known. In our two examples, Mr. Costik founded the “CGM in the Cloud” Facebook group, and Dr. Webster publicly released the MoleMapper through the iOS app store. Again, additional considerations for policy makers may arise as concerned caregivers share their unregulated mHealth research activities with others.

3. The Empowered Community Persona

Empowered communities may be a direct outgrowth of the empowered patient or concerned caregiver personas or may congregate around an ideal and then discover unregulated mHealth research as a tool. In the first case, individuals with a condition and/or their caregivers band together to use mHealth tools to drive research or influence the research or clinical care ecosystem. In the latter, a community ideal, such as democratization of science, opens the door to mHealth experimentation. A key impetus for empowered community development is power in numbers: converging with others around a condition or ideal to amplify the community’s impact on research or the clinical care ecosystem through financial or political influence.

Empowered communities that have grown from empowered patients and concerned caregivers include the already mentioned mentioned APS,²⁸ CGM in the Cloud,²⁹ and MoleMapper app³⁰ examples, as well as groups like Crohnology,³¹ an online, patient-powered research network founded by Sean Ahrens, a man living with Crohn’s disease. Crohnology is a platform for community sharing of observations and interventions for Crohn’s disease symptom mitigation and control. Further, although not yet manifest in the mHealth space, we anticipate concerned caregiver-initiated crowdfunding mHealth efforts like those seen in rare disease communities to accelerate gene therapies.³²

An example of a community ideal-nucleated empowered community is BioCurious,³³ a non-profit hacker/makerspace in Silicon Valley. BioCurious was founded on the belief that biology should be accessible, affordable, and open to everyone. As a community-run lab, it serves as a physical meeting space for biohackers, citizen scientists, and others who want to experiment. Unregulated mHealth tools and approaches are rapidly becoming integrated within its varied project portfolio.

When assessing the policy concerns surrounding empowered communities, we must think about the group as the unit for analysis. Groupthink and peer pressure may play outsized rolls in even the most empowered community. Further, the volume of data collected by such groups may (inadvertently) legitimize insights derived from faulty measurements.

4. The Self-Discoverer Persona

Whereas empowered patients and concerned caregivers use mHealth to treat or manage specific health conditions, self-discoverers use mHealth to better understand and improve their health. The ultimate aim of self-discoverers is to obtain insights that might help them avoid disease or improve their general state of wellness. So defined, self-discoverers include individuals who upload their raw genetic data to third-party genetic interpretation services, including mHealth tools, to learn about their genetic disease predispositions or to purchase diet or fitness plans or nutritional supplements customized to their DNA.^{Reference Nelson and Fullerton34} In some cases, the individual’s primary objective in sharing their raw genetic data with such services is to understand their ancestral origins or identify genetic relatives.³⁵ When those services also provide health and wellness information, the participants become self-discoverers, even if unintentionally. On the other end of the spectrum are self-discoverers who intensively record their fitness, sleep, nutritional, or physiological data using mobile devices for the specific purpose of obtaining personal health or wellness insights. As an example of this kind of self-discoverer, members of the Quantified Self (QS) community recently organized to conduct high-frequency self-testing of their blood lipid levels using portable analyzers.^{Reference Grant, Wolf and Nebeker36}

In many cases, self-discoverers do not themselves conduct research with the personal data that they collect. However, just as Narcissus, who could not pull himself away from his own reflection, might have prompted others to investigate what he was doing, self-discoverers also can attract scientific attention. For example, openSNP maintains a public database of users’ genetic data and research interest in those data continues to grow.^{Reference Greshake and Haeusermann37} Further, some users of third-party genetic interpretation services share the results with their clinicians, which has prompted research into, among other things, the validity of the results.^{Reference Tandy-Connor and Moscarello38} Finally, self-discoverers are participating in studies of their efforts. For example, some participants in the QS blood-testing project elected to participate in a study of the feasibility and utility of systematic ethical reflection as a mechanism for providing ethical oversight of self-monitoring activities.³⁹

For self-discoverers, relevant ethical and policy concerns include the accuracy of the health and wellness data that are the bases of their activities. If the data are inaccurate, self-discoverers might be prompted to act in ways that are costly and potentially harmful. Even if the information is accurate, it might be presented in a way that is confusing or misleading, causing users (and their clinicians) to misunderstand them.^{Reference Allen40} Finally, such services might not sufficiently safeguard against the unauthorized disclosure of users’ information to others or their downstream uses of that information to discriminate or embarrass.^{Reference Guerrini41} One downstream use that recently has become the subject of vigorous debate is searching of public genetic databases by law enforcement to generate investigative leads in criminal cases.^{Reference Murphy42}

5. The Grinder Persona

Also called bodyhackers, body modifiers, and doit-yourself (DIY) cyborgs, grinders are individuals who implant devices, including mHealth devices and devices that transmit information to mHealth devices, into their bodies.^{Reference Popper43} Whereas self-discoverers aim to understand their bodily functions, grinders seek to enhance or otherwise change those functions, sometimes in pursuit of transhumanist objectives to unite man with machine.⁴⁴ Grinders who qualify as unregulated mHealth researchers include Tim Cannon, co-founder of Grindhouse Wetware, who implanted his open source biotechnology company’s Circadia device into his skin to transmit biometric data to his mobile phone,⁴⁵ and Anastasia Synn, a self-described “cyborg magician” who implanted a temperature chip in her arm.^{Reference Robbins46}

Although grinders do not conduct traditional scientific studies, their activities are in the realm of research given that they are testing the body’s response to the implantation or are coated with materials that have not been established as safe and effective for body implantation.^{Reference Hines47} Further, grinders’ activities take place alongside, and so undoubtedly influence, the regulated research and development of medical devices that are intended for body implantation. Kevin Warwick, for example, is a biomedical researcher with academic appointments who famously implanted a device in the nerves of his arm that he used to control a robot hand via the internet using his thoughts.^{Reference Warwick48} The same device has since been used by scientists to restore movement in paralyzed persons.^{Reference Bouton49}

Because many devices implanted by grinders are not intended for human implantation and implants are not always performed or subsequently monitored by medical professionals, grinders’ activities raise serious safety concerns. Indeed, in 2017, an Australian woman died from septicemia following the implantation of a plastic snowflake under the skin of her right hand, which became infected.^{Reference Russell50} The man who implanted the snowflake was not a healthcare professional and has been charged with manslaughter in her death.⁵¹ Although the case did not involve an mHealth device, it highlights liability issues for those who perform any kind of body modification and also potential gaps in oversight where local medical, piercing, and tattoo licensure laws do not cover body modification procedures. At the same time, government interference with grinders’ activities raise important questions about what are appropriate limits to bodily autonomy.

6. The Data Sharer Persona

Individuals who use mHealth for personal health or self-exploration purposes often collect data about themselves as a result of these activities that are potentially valuable to others. When they transfer those data from or with the help of mobile devices, they become data sharers. Some sharing is intended solely to support scientific discovery that might help others and is made without any expectation of or even desire for personal gain. For example, more than 80% of customers of 23andMe, a direct-to-consumer genetic testing firm, provide permission for the firm to use their genetic data in research studies that the firm conducts or supports.⁵² Customers might also download their raw genetic data onto their mobile phones and then contribute those data — along with fitness tracking and social media data — to other research initiatives, such as those hosted on Open Humans.⁵³

While altruism is a common reason for sharing, some data sharers are motivated by financial gain. Recently, businesses have emerged to help individuals monetize their health information — in some cases using mHealth devices. For example, the CoverUS app has plans to broker the sale of users’ health data to interested buyers in exchange for cash rewards.⁵⁴ Similarly, Hu-manity.co has developed a mobile app through which users will soon be able to sell their medical histories and other “inherent human data.”⁵⁵ Hu-manity.co describes the ability to receive fair market value for such data as a “human right” that the company will “fight for.”⁵⁶ Where people are in possession of especially valuable health data because, for example, they belong to very small or difficult-to-recruit research populations, they might limit their sharing to only the highest bidders. IIn these cases, data sharers might be more appropriately called data scalpers.

Data sharers not only facilitate research through direct contributions to research studies. If use of personal data brokers becomes common, data sharers also have the potential to change how scientists amass data. As one example, if personal health data comes to be viewed as the valuable legal property of the people they describe, studies might need to increase their standard compensation to recruit and retain participants. More serious ethical concerns will be raised if these and other changes have the cumulative effect of reducing every interaction between scientists and those whose data they wish to study to a financial transaction. Other policy issues are raised when recipients of data do not honor the terms under which contributions are made, such as recipients’ commitments to keep those data private and secure.

Finally, although data sharers do not usually retain legal interests in the data they give away, they might retain moral interests in how the data are used and controlled. This can result in public controversy, as when 23andMe customers who had opted into research use of their genetic data were upset by news that the company had obtained a patent related to Parkinson’s disease using their data.^{Reference Sterckx57} The customers were concerned that the patent would be used to restrict access to genetic testing, contrary to the customers’ belief that their data would be used to help patients.⁵⁸

7. The Professional Scientist Persona

The principal focus of professional scientists in unregulated mHealth contexts is the generation of generalizable knowledge. This persona may, as a result of their work, derive profit (or accrue financial losses), but the fiscal implications of the research they conduct are not the primary impetus for or refiner of their work. Their engagement in unregulated mHealth research arises from their paid responsibilities.

For decades, the Federal Wide Assurance for the Protection of Human Subjects (FWA) agreement has complicated the professional scientist’s relationship with unregulated research generally, and more recently with unregulated mHealth research, by tying ethics oversight to the funding source for a given study. Through their FWA, organizations who have received federal research funding have had the option to extend federal research regulations to their unregulated research activities (colloquially known as “checking the box”).⁵⁹ For example, in 2013 Sage Bionet-works, a non-profit research organization,⁶⁰ received funding from the Robert Wood Johnson Foundation (RWJF), a philanthropy dedicated to public health, to develop the Parkinson mPower and Share the Journey mHealth studies.^{Reference Comstock61} This work would have constituted unregulated mHealth research by Sage Bionetworks’ professional scientists had Sage, which received concurrent federal funding for other projects, not previously voluntarily extended their FWA to cover all their research activities. Interestingly, the percentage of FWA recipients who “checked the box” declined markedly, from around 90% at its peak in the 1980s^{Reference Odwazny62} to less than 50%⁶³ before the final revisions to the Federal Policy for the Protection of Human Subjects (the Common Rule) went into effect in January 2019.⁶⁴ The revised Common Rule withdraws the option for organizations to check the box, eliminating voluntary compliance with the Common Rule by organizations,⁶⁵ although there has been some discussion that the Office for Human Research Protections (OHRP) would extend this option for an unspecified period of time.⁶⁶

In the absence of customary peer, institutional, and regulatory oversight, professional scientists’ mHealth research may not be scrutinized for scientific or ethical validity. Without the mandated support of ethics and regulatory professionals, the professional scientist persona may not recognize (or accept) the full extent of the ethical responsibilities they have for their research.^{Reference Metcalf, Moss and Boyd67} Many have pointed to Facebook’s “emotional contagion” study as an example of professional scientists abdicating ethical responsibility for their work while operating in an unregulated mHealth context.^{Reference Chambers68} Further, the misconduct of research by professional scientists has the potential to sow distrust in the scientific enterprise and the legitimacy of rigorously conducted research.

8. The Data Entrepreneur Persona

Data entrepreneurs harvest mHealth data from platforms and monetize it. Their monetization of mHealth data may result in health innovation or discovery or may be purely for commercial gain (e.g., targeted marketing). Although a data entrepreneur may desire community or individual health benefit, all data entrepreneurs are driven by financial gain.

Examples of unregulated mHealth data entrepreneurs include companies like TREND Community, a for-profit company founded by parents of a child with a rare disease.⁶⁹ TREND, with the permission of rare disease online community groups, harvests social media data from disease-specific discussion groups on large platforms (e.g., Facebook) using sanctioned developer APIs.⁷⁰ TREND then digests the anonymized data using natural language processing and machine learning to identify novel themes, like symptoms that are potentially treatable by drugs. Themes are returned to the community from whom the data were derived for free and are sold by TREND, for example to pharmaceutical companies.

Strava, a free online platform for athletes to share mHealth data, is another example of a data entrepreneur.⁷¹ Strava digests mHealth data of tens of millions of users and monetizes it for advertising and through Strava Metro,^{Reference Gulley72} a form of public health heat mapping for urban planners and municipalities. Following astute review of previously released data,^{Reference Robb73} and subsequent outcry from the Pentagon,^{Reference Chappell74} Strava recently updated the privacy settings of its heat mapping feature.^{Reference Lumb75}

Challenges faced by data entrepreneurs include operating within the limits of unregulated or under-regulated mHealth platforms from which the data they seek to monetize are derived. In the case of TREND Community, the company struggles with the notification process they use for online community groups before they harvest data⁷⁶ — beyond agreements with the moderators of the group and encouraging moderators to post about the upcoming data harvest, the majority of social media platforms do not (currently) facilitate implementing informed consent processes or even the ability to easily bifurcate groups to honor opt-in or opt-out preferences. Further, returning insights that may eventually be discarded after more rigorous investigation could harm individuals, care-givers, or communities who lack access to interpretation resources.

9. The False Flag Persona

The false flag persona uses shell identities to access mHealth information that might otherwise be protected under federal regulations to further their research aims. By exploiting unregulated or under-regulated mHealth platforms, false flags serve as a conduit of protected information in unprotected form, facilitating uses of health information that would be illegal if those data were collected by other means.

Historical misuse of workers’ health information led to many of the very protections false flags seek to circumvent. The advent of mHealth platforms, and the dearth of regulation surrounding the information gathered through them, has only provided new opportunities for such exploitation.^{Reference Anjunwa, Crawford and Schultz77} Workplace efficiency innovations and employee wellness programs are two potential examples. Recent patent applications from Walmart^{Reference Mateescu, Nguyen and O’Donovan78} and Amazon^{Reference Yeginsu79} highlight larger employers’ desire to maximize the efficiency of their workforce. At the same time, these devices may collect — purposefully or inadvertently — health information about employees that if collected in traditional contexts would be considered protected and unavailable to employers for use in employment decision making. Likewise, companies large and small have adopted employee wellness programs,^{Reference Schencker80} tracking an ever-increasing panoply of health data^{Reference Rowland81} that many worry will be used to discriminatory ends.^{Reference Holley82}

The exploitation of loopholes in the protection of mHealth data should concern policy makers, especially considering the granularity and specificity of those data. Workers have few protections against false flags.^{Reference Delgado83} Lack of harmonization of existing federal regulations may open the door for false flags.^{Reference Lazzarotti84} Concerns are also raised by the lack of transparency regarding how, exactly, false flags are using the data that they collect or with whom they are sharing and selling it.

10. The Sociopath Persona

Finally, the sociopath is interested in mHealth as a vehicle to create chaos and cause harm. The socio-path might achieve these objectives by tampering with medical devices that talk to mobile devices, such as pacemakers and spinal simulators, or the mobile devices or mHealth apps that report or interpret such data; exposing the vulnerability of these devices and apps to enable attack by others; altering data used or generated by these devices and apps; or stealing such data for ransom, private sale, or public disclosure. mHealth might also be used by sociopaths to perpetuate harmful stereotypes or discriminatory agendas. For example, it has recently come to light that white nationalists are using direct-to-consumer genetic testing to confirm their “whiteness” and justify their racist claims.^{Reference Boodman85}

Although theft of health data is unfortunately not unusual,^{Reference Vincent86} to our knowledge, no cases of mHealth device or data interference or manipulation have yet been reported. Still, vulnerabilities are well known and are sure to be exploited for misanthropic purposes. In recognition of this constant threat, attendees of the 2019 DEF CON conference were not allowed to enter the Biohacking Village Device Lab to view and conduct security testing of the medical devices on display until they had signed an agreement to “act in good faith, in the best interest[s] of patients,” and “avoid inadvertently putting life and safety at risk.”⁸⁷ This commitment is consistent with the broader effort of a grassroots group of white-hat hackers to establish a Hippocratic Oath for Connected Medical Devices.^{Reference Woods, Coravos and Corman88}

Sociopaths themselves may not conduct research with mHealth devices or data. However, they necessarily impact the R&D activities of device manufacturers, which test and refine anti-tampering features for products. Recently, the FDA recalled two insulin pumps after identifying potential risks related to the wireless communication between the pumps and other devices, such as blood glucose meters, continuous glucose monitoring systems, remote controllers, and USB devices. The FDA was concerned that the pumps could be remotely accessed by someone other than the user or caregiver and programmed to deliver unsafe doses of insulin.^{Reference Wicklund89} The pumps will likely be redesigned following significant investigation to address this access problem.

By weaponizing mHealth apps, devices, and data, sociopaths raise significant public health concerns. Unlike empowered patients, self-discoverers, and grinders, who accept the risk that they might be harmed by their activities, sociopaths harm others who have not and would never give such consent. Moreover, sociopaths can potentially injure a large number of people within a short period of time and might be next to impossible to avoid, identify, or bring to justice, especially if they are located in a different country than where their attacks take place. Finally, the activities of sociopaths also raise complex policy questions regarding what kinds of security breaches are foreseeable, who is liable when such breaches occur, and what role regulators should play in ensuring that manufacturers timely identify and address vulnerabilities.