The present situation
Health workers using our CHIS app log in once, with a username and password, on the day the app is set up. After that the app stays logged in until someone logs out. In practice, nobody logs out. The session simply never ends.
This is a documented CHT design choice, and it exists for good reasons. CHT is offline-first. Health workers work where there is no network for hours at a time, and forcing a re-login means making work more hectic.
But it creates a gap. Our health workers use both facility phones/tablets and their own personal phones. Anyone who picks up that device — a colleague at the health post who is not an authorised user, a family member at home, a friend borrowing the phone — is already inside the app. No password, no barrier. One tap on the icon and they can browse household profiles and access to personal information of clients already in CHT..
Why a device PIN/Pattern does not solve it
-
Facility devices are shared by design. If a health post tablet has a PIN, everyone at that facility knows it — including staff who are not CHT users.
-
A device lock protects the phone, not the app. Once a health worker unlocks her own phone, every app on it is open.
-
Family members usually know the phone PIN. In our context it is shared knowledge, not a secret.
Device security and application security answer different questions.
What is at risk
Through the Family Health Profile and routine CHIS workflows, the app holds names, ages, household location with GPS, pregnancy and postnatal status, family planning method, child immunisation and nutrition status, chronic conditions, referrals and phone numbers.
In a village, It can cause social harm to the families who trusted a health worker with it. The app stays logged in is hard to defend as a reasonable measure. Also they are using their personal device to provide care and service using CHT.
What we are asking for
An app-level lock in the CHT Core Framework, of the kind WhatsApp, banking apps we already use:
-
The app locks itself after a configurable period of inactivity, or when sent to the background.
-
The user reopens it with a short PIN kept for CHT.
-
After repeated wrong attempts, fall back to normal username and password login.
Why now
We are scaling CHT in various region. Every scale-up puts more devices carrying identifiable household health records into private homes. What is manageable at pilot scale becomes a systemic exposure at provincial scale — and every CHT deployment running on shared or personal devices has the same problem.
When a partner organization or the government implementer asks whether someone else can open this app, our honest answer today is yes. An app lock would change that answer, and it is not a large or exotic feature to build.