We followed five of the six stages of the framework for scoping reviews proposed by Arksey and O’Malley [29]: (1) identifying the research question; (2) identifying relevant studies; (3) study selection; (4) charting the data; and (5) collating, summarizing, and reporting the results. The sixth stage of the framework is optional, which was not included in this scoping review. It involves a consultation exercise with stakeholders to gain a more holistic view of the issues under evaluations. Additionally, we used the PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) Extension for Scoping Reviews checklist to guide the presentation of this scoping review [30]. We applied existing definitions to identify common ethical concerns related to informed consent, privacy and confidentiality, and data security and protection. We also used team consensus to classify concerns that fit within legal, regulatory, and sociocultural categories.

Privacy of health information refers to an individual’s right to control the acquisition, uses, or disclosures of his or her identifiable health data for others [31,32]. Confidentiality refers to the obligations of those who receive information to respect the privacy interests of those to whom the data relate [31,32]. Data security refers to the physical, technological, or administrative safeguards or tools used to protect identifiable health data from unwarranted access or disclosure [32]. Data protection is closely related to data security, which refers to adopting appropriate, reasonable, technical, and organizational measures to prevent loss, damage, or unauthorized destruction or processing of personal data [33]. General ethical concerns refer to research processes that fail to uphold or violate the principles of respect for persons, balance of potential benefits and harms, and equitable sharing of benefits and burdens across research groups [27].

The primary research question was: what are the ethical, privacy, and data security concerns pertaining to the use of mHealth technologies and mobile phone data for public health research in the East African region? The rationale for focusing on the five countries in East Africa was that the ethics and mHealth technology landscapes are likely to be similar in several ways within the same region. Therefore, the findings could inform regional guidelines and policies.

A systematic search of the literature was performed on November 18, 2020, in the PubMed database using the search terms “mobile,” “ethics,” and “East Africa.” The detailed search strategy and terms used are provided in Textbox 1. The search was limited to English and included only studies focused on the East Africa region. We considered only articles published from 2000 to 2020 due to the widespread use of mobile technology during this period in the region of interest.

Retrieved studies reporting on mobile technology and health in the East African region were included for further review. Two independent reviewers for each article applied the inclusion and exclusion criteria, with an additional author serving as the tiebreaker in the event of uncertainty regarding whether an article met the inclusion or exclusion criteria. Studies were included if they were (1) related to mobile technology and health, (2) published in English from 2000 to 2020, (3) available in full text, and (4) conducted in the East African region. We excluded articles that (1) were conference proceedings, (2) without full text or presenting an abstract only, (3) systematic and literature reviews, (4) research protocols, and (5) reports of mobile technology in animal subjects.

Two authors (CH and CB) performed abstract screening. Three authors (KM, CH, and CB) subsequently reviewed full-text articles, and extracted and stored the data in a Microsoft Excel database developed for this review. From the eligible studies, we extracted the title, publication year, journal name, impact factor, target population, geographic region, setting, and relevance to mHealth and ethics. For each stage of the review, two reviewers (KM and CB) independently reviewed each full-text article. Discrepancies were discussed collectively until consensus was reached.

Given the diversity of articles included in the final scoping review, we employed an iterative team discussion approach to the analysis in order to establish the main themes related to ethical and related concerns. We use descriptive statistics to summarize the characteristics of the studies, including country of publication, year of publication, area of focus, study design, and mHealth intervention employed.

The search identified 94 articles eligible for further review (Figure 1). Of these, 59 did not meet the inclusion criteria and 5 additional studies were excluded based on a review of titles and abstracts. We included 33 studies published in 22 journals in the final scoping review.

The 33 articles retained in the final scoping review represent studies conducted in three out of five East African countries, including 14 (42%) from Uganda and 13 (39%) from Kenya (Table 1). The number of studies published on ethical concerns of mHealth technology use and mobile phone data increased over time, beginning with one in 2009 and climbing to six in 2018. The articles were mostly published in the journal AIDS and Behavior, followed by Journal of Medical Internet Research and BMC Public Health. The majority of mHealth interventions were SMS-based, followed by mobile phone app–based, whereas CDR aggregate data analysis was seldom used among the studies we reviewed. More than half of the studies included were observational in study design, followed by a mixed methods design. Two of the 33 studies included met the eligibility criteria but did not mention ethical concerns beyond compliance with human research and approval from respective institutional review boards.

Three main categories of concerns related to the use of mHealth technologies and mobile phone data can be conceptualized as (1) ethical issues (adequate informed consent, privacy and confidentiality, data security and protection), (2) sociocultural issues, and (3) regulatory/legal issues. These themes are not necessarily mutually exclusive. A detailed summary of each study by theme is provided in Table 2. Ethical concerns were predominantly identified in the included studies, which are discussed in detail below.

Three mHealth studies (9%) described concerns related to complex gender dynamics and sociocultural beliefs. In Tanzania, two studies revealed gender-based power imbalances among women and men. Female participants reported low mobile phone ownership and expressed concerns about spouses being suspicious that if a wife owned a phone, it may facilitate infidelity in the relationship [56,60]. In Uganda, female participants expressed sociocultural concerns pertaining to using mHealth interventions to support health. For example, some participants were reluctant to use IVR for health purposes because of community beliefs that there are “evil spirits” that could claim the life of the recipient if one received unknown calls. In addition, women participants were particularly apprehensive about IVR surveys being sent to their cell phones if they were being administered in a male voice; they feared that this would raise suspicion of cheating by their spouses and could spark domestic violence [43]. Phone sharing is particularly common in countries within Africa, thus creating another potential source of privacy breaches and sociocultural concerns.

Two studies raised regulatory and legal concerns regarding using mHealth technology. These studies reflect the perspectives of the researchers governing the studies and the key stakeholders surveyed. In Tanzania, researchers concluded that the findings of their study on reproductive health provided impetus for stronger data protection legislation in regions such as rural Tanzania [56]. Protecting individuals’ health data is particularly important given the inherent sociocultural beliefs surrounding the secrecy of health information [56]. In Uganda, researchers indicated that the processes for mobile phone surveys should follow standard international regulatory guidelines for sharing personal information while also ensuring alignment with existing local laws and policies [35].

The aim of this scoping review was to synthesize the current state of evidence on the ethical, sociocultural, legal, and regulatory concerns related to the use of mHealth technologies and mobile phone data for public health research in the East Africa region. Our review builds on a growing body of work examining concerns with mHealth data security, privacy, and confidentiality [24]. To our knowledge, this is the first study to synthesize end-user and public health research concerns pertaining to mobile phone data use in the East Africa region. Five interrelated themes emerged as key concerns with the use of mobile phone data and mHealth interventions: adequate informed consent, privacy and confidentiality, data security and protection, sociocultural issues, and regulatory/legal issues. Of equal concern is the collection, use, and sharing of personal information such as CDRs to third parties without the notice or consent of consumers. Countries need to put in place legislation to protect the privacy and secure these personal data while facilitating their use for the good of the populations. In the future, these themes and others could inform the formulation of a framework for ethical regulatory policies using mHealth in the East African Community (EAC) region.

African countries have rapidly adopted the use of mobile technologies to support their daily needs such as social, economic, education, and travel needs, among many others. Specifically, the East African region shows a dominance in the adoption of mHealth programs to overcome some structural barriers in the health system [63]. Studies in high-income countries deploying mHealth interventions have revealed concerns mostly related to data privacy, security, storage, and transmission [64-66]. In contrast, most studies in the East African region highlight concerns about the potential disclosure of personal health information at the user interface, such as reading text messages. The pace of development and access to mobile technology could partly explain these differences in concerns between high- and low-income settings.

Sociocultural issues seem to influence the differential levels of positive and negative perceptions around data privacy and confidentiality concerns by gender and user group across the East African region (see Multimedia Appendix 2). For example, privacy and confidentiality concerns in Uganda and Tanzania highlighted gender norms and cultural beliefs that exist around secrecy about pregnancy and childbirth due to a fear of supernatural powers that could cause harm to the mother and unborn child. These beliefs could inhibit the willingness to share pregnancy-related personal information via the phone [67,68]. In addition, the issues of phone sharing due to limited mobile phone ownership among women could precipitate sociocultural tensions. For example, spousal conflicts and violence, especially directed toward female mHealth users, have been reported when women receive various forms of health support from male health care workers. Although mHealth interventions are beneficial, implementers must be mindful to anticipate the issues that may result from phone sharing in the cultural context of Africa [69].

mHealth data have the potential to enhance or jeopardize privacy. For example, the HIV-related stigma and discrimination among PLWHA in Africa could be attenuated if disclosure of HIV status is kept confidential. The findings of this scoping review suggest that among PLWHA mHealth interventions, supporting patient care should be accompanied by unique personal identification numbers or passwords to facilitate protection of privacy and confidentiality of HIV-related information. Several studies from Kenya and Uganda revealed that populations experienced difficulty in understanding the capability of mHealth interventions, which in turn raises questions about the informed consent process [34-36].

The lack of comprehensive ethical frameworks to guide the use of mHealth in public health research and practice remains a challenge across countries in the EAC region [70]. Very few studies included in this review explored the legal concerns of data use beyond pointing to the need for legal and regulatory policies for data protection and privacy of personal data. In 2018, MEASURE Evaluations published a report of guidelines developed for Kenya and Tanzania to help mHealth program managers and Ministry of Health officials systematically address mHealth data privacy and security issues [24]. The authors acknowledged that the guidelines were limited in scope, only serving as a building block that would allow stakeholders to be informed, and guide the teams responsible for developing and implementing responsible data practices, especially data security and privacy.

Legal regulation of personal health information within the EAC is not uniformly developed. The Republic of Uganda [33] and the Republic of Kenya [71] passed their data protection laws in 2019, whereas Rwanda passed a similar law in 2021 [72]. Tanzania currently has a draft data protection bill that has not yet passed into law, whereas Burundi does not have a law that specifically regulates personal data protection. Based on the experience of our health research team in Uganda, the new law is not yet operationalized into clear policy guidance, particularly in the context of public health research and practice. As such, we have encountered barriers to access CDR data from telecommunication companies even when we present written and signed consent from the cell phone owners. To the greatest extent possible, each nation needs to cooperate to set up regional mobile technology standards reflecting its local situations and government policy regulations [65]. The results of our scoping review serve to highlight concerns and gaps that must be addressed to create an enabling policy and regulatory environment for public health researchers. Additionally, public views on the use of CDRs in health research must also be explored.

Our work has implications for public-private partnerships, given the potential mutual benefits from CDRs, a largely untapped emerging data type that is collected by telecommunication companies in the EAC region. First, the public and private sectors could share expert human capital financial and infrastructural resources to catalyze the growth of these entities within the region. For example, the public health research enterprise could quickly access a large quantity of rich data on spatial and temporal mobility patterns of the population, which are routinely collected but underutilized by telecommunication companies. This approach to collecting specific data would likely be far more efficient and cost-effective than traditional methods. Second, the private sector could gain new business insights about the populations they serve based on a range of geospatial or data-mining analyses and interpretations generated by public researchers and data scientists. In Africa, many lessons can be learned from major innovations in banking and agriculture that have already spawned from the extensive digital infrastructure. Lastly, we envision a unique opportunity for the public health and private sectors to engage jointly with regulatory policymakers to advance data governance policies for mutual benefit. It is important to note that this process will likely be dynamic given the rapidly evolving mobile technology landscape.

This scoping review has some limitations. First, we acknowledge that we might have missed studies relevant to mHealth and ethical, legal, or privacy concerns in the East Africa region if they were published in electronic databases other than PubMed, in a language other than English, or outside of the period of our study. Second, studies published from Rwanda and Burundi may have been excluded from this review specifically because English was specified as the only language for articles that met other inclusion criteria. In this case, any published articles written in French could have been excluded; however, during our search, we did not identify any such articles in the initial screening. Overall, we believe that the majority of the public health research articles are accessible through PubMed. Therefore, we do not expect that our findings and conclusions were significantly influenced by any papers we might have missed.

This scoping review identified major cross-cutting ethical, regulatory, and sociocultural concerns related to use of data from mobile technologies in the East African region. A comprehensive framework that accounts for ethical, sociocultural, legal, and regulatory concerns in the cultural context of the EAC region is needed to guide the safe use of mobile technology data for public health research purposes.