Why anyone at Apple decided that it was acceptable to log medical data in such an unsafe way?
I currently work in an IT health care company in Europe, and we must alway store the data fully encrypted with strict access control. We even decided to not make sure to not persist any medical data on user devices to not take unnecessary risks. And there, Apple logs everything on the iPhone? Why?
What's funny about it is that apparently some of their WatchOS/device combos have FIPS 140-2 and FIPS 140-3 certifications. Pretty useless security theatre if you then shuffle the data around to other operating systems or into arbitrary servers with complex infrastructures.
I have some doubt with respect to whether what author claims is "medical data" is indeed medical. Practically speaking, the data he mentions seems like the things collected by Apple Watch and stored in the Health app. There is indeed heart rate tracking, but can we really label this data as medical? IMHO "medical" would relate more to professional diagnosis, treatment etc. which according to Apple is stored in an encrypted form [1]. Garmin devices also collect heart rate, sleep stats etc. and I have never thought of these as medical (health-related yes, but not medical). The line is thin though.
Since you work in the industry, perhaps you could share your opinion how such data should be treated?
> menstrual cycle length, biological sex and age, whether user is logging sexual activity, cervical mucus quality, etc.
These are hardly data collected by Apple Watch, unless someone is being inventive with one. These come from HealthKit. Which is alarming as HealthKit can also sync your EHR from health providers.
> There is indeed heart rate tracking, but can we really label this data as medical?
The detailed data (ECG level) is medical enough that devices that measure it are regulated. That’s why some features aren’t available in some countries.
I currently work in an IT health care company in Europe, and we must alway store the data fully encrypted with strict access control. We even decided to not make sure to not persist any medical data on user devices to not take unnecessary risks. And there, Apple logs everything on the iPhone? Why?