ISO/PRF TS 82304-2

TECHNICAL ISO/TS
SPECIFICATION 82304-2
First edition
Health software —
Part 2:
Health and wellness apps—Quality
and reliability
Member bodies are requested to consult relevant national interests in IEC/SC
62A before casting their ballot to the e-Balloting application.
PROOF/ÉPREUVE
Reference number
ISO/TS 82304-2:2021(E)
ISO 2021
---------------------- Page: 1 ----------------------
ISO/TS 82304-2:2021(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO 2021

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

Foreword ........................................................................................................................................................................................................................................iv

Introduction ..................................................................................................................................................................................................................................v

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms and definitions ..................................................................................................................................................................................... 1

3.1 General terms ........................................................................................................................................................................................... 1

3.2 Terms relating to apps ...................................................................................................................................................................... 5

3.3 Terms relating to risk management ...................................................................................................................................... 7

4 Health app assessment process ............................................................................................................................................................ 8

4.1 Conformity assessment ................................................................................................................................................................... 8

4.2 Quality requirements ........................................................................................................................................................................ 8

4.3 Health app quality report .............................................................................................................................................................. 9

4.4 Health app quality evidence pack ........................................................................................................................................... 9

4.5 Health app quality label .................................................................................................................................................................. 9

5 Quality requirements ...................................................................................................................................................................................... 9

5.1 Product information ........................................................................................................................................................................... 9

5.1.1 Product ..................................................................................................................................................................................... 9

5.1.2 App manufacturer ........................................................................................................................................................10

5.2 Healthy and safe ..................................................................................................................................................................................11

5.2.1 Health requirements..................................................................................................................................................11

5.2.2 Health risks ........................................................................................................................................................................13

5.2.3 Ethics .......................................................................................................................................................................................17

5.2.4 Health benefit ..................................................................................................................................................................18

5.2.5 Societal benefit ...............................................................................................................................................................22

5.3 Easy to use ...............................................................................................................................................................................................23

5.3.1 Accessibility ......................................................................................................................................................................23

5.3.2 Usability ................................................................................................................................................................................25

5.4 Secure data ..............................................................................................................................................................................................29

5.4.1 Privacy ...................................................................................................................................................................................29

5.4.2 Security .................................................................................................................................................................................35

5.5 Robust build ...........................................................................................................................................................................................41

5.5.1 Technical robustness .................................................................................................................................................41

5.5.2 Interoperability ..............................................................................................................................................................44

Annex A (Informative) Health app quality label ....................................................................................................................................46

Annex B (Informative) Health app quality score calculation method .............................................................................53

Annex C (informative) Rationale ...........................................................................................................................................................................57

Annex D (informative) Product safety and lifecycle process recommendations .................................................58

Annex E (informative) Application profile – Contact tracing apps .....................................................................................66

Annex F (informative) Ethical considerations in health apps .................................................................................................69

Annex G (informative) Potential uses of this document ................................................................................................................72

Bibliography .............................................................................................................................................................................................................................74

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodies (ISO member bodies). The work of preparing International Standards is normally carried out

through ISO technical committees. Each member body interested in a subject for which a technical

committee has been established has the right to be represented on that committee. International

organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.

ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of ISO documents should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

any patent rights identified during the development of the document will be in the Introduction and/or

Any trade name used in this document is information given for the convenience of users and does not

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www .iso .org/

This document was prepared by Technical Committee ISO/TC 215, Health informatics, in collaboration

with Technical Committee IEC/TC 62, Electrical equipment in medical practice, Subcommittee SC 62A,

Common aspects of electrical equipment used in medical practice, and with the European Committee for

Standardization (CEN) Technical Committee CEN/TC 251, Health informatics, in accordance with the

Any feedback or questions on this document should be directed to the user’s national standards body. A

Health and wellness apps are a fast-growing market, and there are now hundreds of thousands, with

the most popular of these having many millions of downloads each. Some of these apps fall under

medical devices regulations, most do not. These apps are often promoted directly to consumers through

app stores without going through any formal evaluation. The apps often collect sensitive personal

information yet do not have appropriate privacy controls, and provide advice on topics such as fertility,

diet or activity that are not supported by any evidence. There are widespread concerns about the risks

involved. At the same time, health apps that have proven to be effective and add to quality of life and

Many health organizations have projects to evaluate, endorse and procure apps that meet locally defined

requirements. These activities are important for any app developer who want to promote or sell their

product to or through providers of health and wellness services, as providers want the reassurance that

the apps they recommend to patients will be safe, reliable and effective. However, the cost of responding

to different extensive sets of criteria and different evaluation regimes in each country, organization, or

region is a barrier for app developers wanting to make their products available in multiple markets.

It is also a problem for those evaluating apps and maintaining libraries of health and wellness apps.

They can miss out on products that effectively address health issues and health system inefficiencies,

do not benefit from economies of scale of others evaluating the same apps and different evaluations

can contradict one another, causing further confusion instead of trust. Because of the time investment

involved, the vast majority of apps are not evaluated at all, although top 10 lists suggest otherwise.

There are several International Standards on health software related to product safety and lifecycle

processes that are applicable to all health software, including health apps. This document provides

quality requirements and health app quality labels as ways for app manufacturers and app assessment

The working practice within app development is to deliver a focused piece of functionality, building

on an existing platform - often with a small team doing the work who can be unfamiliar with health

software development. This document includes Annex D to provide guidance specific to this community.

A vibrant transparent market for health apps will benefit individuals and programs across the world

that are addressing issues such as aging population, unhealthy lifestyles, chronic diseases, affordability

of or constrained budgets for health and care, unequal quality and access to health services, and

The quality requirements (Clause 5) and health app quality score calculation method (Annex B) have

been developed with a Delphi consensus study. Further input was gathered with surveys, interviews,

and review of existing standards and health app assessment frameworks. The health app quality label

(Annex A) has been inspired by the EU energy label that is also used in more than 50 countries outside

Europe, the Nutriscore and the FDA over-the-counter medicine label. Think-aloud testing of the health

app quality label with people with low health literacy in the Netherlands and subsequently Egypt and

This document defines a set of questions and supporting evidence that can be used to clarify the quality

and reliability of a health app. A health app quality label is defined to summarize this information in a

The questions and evidence are listed under the following headings taking into account the need to be

This document provides requirements for the specification for the Health App Quality Label in

Annex A, and a calculation method in Annex B to generate the quality score information that is

— Annex D: a walk through the relevant international health software products and process standards,

providing recommendations and explanations, where appropriate, to help those developing or

evaluating health and wellness apps to understand how the standards can be applied;

— Annex E: an example of how a profile of this document can be defined for the assessment of contact

— Annex F: ethical considerations for app developers and evaluators to take into account;

— Annex G: a range of ways that this document can be used by different stakeholders throughout the

This document provides quality requirements for health apps and defines a health app quality label in

This document is applicable to health apps, which are a special form of health software. It covers the

This document is intended for use by app manufacturers as well as app assessment organizations in

order to communicate the quality and reliability of a health app. Consumers, patients, carers, health

care professionals and their organizations, health authorities, health insurers and the wider public can

use the health app quality label and report when recommending or selecting a health app for use, or for

NOTE Health apps can be subject to national legislation, such as for medical devices.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

extent to which products, systems, services, environments and facilities can be used by people from a

population with the widest range of user needs, characteristics and capabilities to achieve identified

Note 1 to entry: Context of use includes direct use or use supported by assistive technologies.

Note 1 to entry: The process of conformity assessment can have a negative outcome, i.e. demonstrating that the

Note 1 to entry: Typical resources include time, human effort, costs and materials.

directly measurable characteristics of a process and/or product that represent objective, demonstrable

state of complete physical, mental and social well-being and not merely the absence of disease of

positive impact or desirable outcome of the use of health software on the health of an individual

act performed for, with or on behalf of a person or population whose purpose is to assess, improve,

representation of an issue related to the health of a subject of care as identified by one or more

Note 1 to entry: According to this definition, a health issue can correspond to a health problem, a disease, an

EXAMPLE A loss of weight, a heart attack, a drug addiction, an injury, dermatitis.

deficit in the current health state compared to aspects of a desired future health state

health-related use for which a product, process or service is intended according to the specifications,

Note 1 to entry: The intended health benefit, patient population, part of the body or type of tissue interacted

with, user profile, use environment, and operating principle are typical elements of the intended use.

Note 2 to entry: A health app has an intended use irrespective of whether it is a medical device. A concept of

“intended use” is used in a more restrictive sense in some medical device regulations.

Note 1 to entry: In many cases the actual user population is different from that originally intended by the

manufacturer. The intended user group is based on realistic estimations of who the actual users of the product

ability of two or more systems or components to exchange information and to use the information that

[SOURCE: IEEE standard computer dictionary: a compilation of IEEE standard computer glossaries.

PII controller that determines the purposes and means of the processing of PII jointly with one or more

instrument, apparatus, implement, machine, appliance, implant, reagent for in vitro use, software,

material or other similar or related article, intended by the manufacturer to be used, alone or in

combination, for human beings, for one of more of the specific medical purpose(s) of

— diagnosis, monitoring, treatment, alleviation of or compensation for an injury,

— investigation, replacement, modification, or support of the anatomy or of a physiological process,

— providing information by means of in vitro examination of specimens derived from the human body,

and does not achieve its primary intended action by pharmacological, immunological or metabolic

means, in or on the human body, but which may be assisted in its function by such means

Note 1 to entry: Products that can be considered to be medical devices in some jurisdictions but not in others include

any information that (a) can be used to establish a link between the information and the natural person

to whom such information relates, or (b) is or can be directly or indirectly linked to a natural person

freedom from intrusion into the private life or affairs of an individual when that intrusion results from

operation or set of operations performed upon Personally Identifiable Information (PII)

Note 1 to entry: Examples of processing operations of PII include, but are not limited to, the collection, storage,

alteration, retrieval, consultation, disclosure, anonymization, pseudonymization, dissemination or otherwise

degree to which a set of inherent characteristics of an object fulfils requirements

ability of a device or a system to perform its intended function under given conditions of use for a

extent to which the user's physical, cognitive and emotional responses that result from the use of a

Note 1 to entry: Satisfaction includes the extent to which the user experience that results from actual use meets

condition that results from the establishment and maintenance of protective measures that ensure a

Note 1 to entry: Hostile acts or influences could be intentional or unintentional.

extent to which a system, product or service can be used by specified users to achieve specified goals

Note 1 to entry: Users of a system, product or service include people who operate the system, people who make

use of the output of the system and people who support the system (including providing maintenance and

Note 1 to entry: Apps were initially established as a category of software developed to run on mobile platforms

for a single or limited number of purposes. However, the distinction between apps and other software

applications has become less clear as a wider range of computing platforms are marketed as supporting apps and

Note 2 to entry: An example is a software application running on a handheld commercial off-the shelf computing

platform, with or without wireless connectivity, or a web-based software application that is tailored to a mobile

[SOURCE: BS PAS 277:2015, 3.1.1, modified — 'and is typically a small application run or accessed on

Note 1 to entry: This can be done to inform the purchasing or recommendation of an app, or as part of a

app intended to be used specifically for managing, maintaining or improving health of individual

[SOURCE: IEC 82304-1:2016 3.6, modified — Changed 'software' to 'app' in term and definition, 'health

software intended to be used specifically for managing, maintaining or improving health of individual

Note 1 to entry: Health software fully includes what is considered software as a medical device.

Note 2 to entry: The scope of IEC 82304-1 refers to the subset of health software that is intended to run on general

[SOURCE: IEC 82304-1:2016, 3.6, modified — 'documents' changed to 'documentation'.]

natural or legal person with responsibility for design and/or manufacture of a health app with the

intention of making the health app available for use, under their own name; whether or not such a health

app is designed and/or manufactured by that natural or legal person themselves or on their behalf by

Note 1 to entry: This ‘natural or legal person’ has ultimate legal responsibility for ensuring compliance with all

applicable regulatory requirements for the health app in the countries or jurisdictions whe