# Making CHT app more secure as part of privacy and data security **URL:** \ **Category:** Development\ **Created:** [September 9, 2026, 10:01am UTC](https://forum.communityhealthtoolkit.org/t/making-cht-app-more-secure-as-part-of-privacy-and-data-security/5735 "2026-09-09T10:01:51Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Pawan\_KB](https://communityhealthtoolkit.b-cdn.net/user_avatar/forum.communityhealthtoolkit.org/pawan_kb/32/2454_2.png) [@Pawan\_KB](https://forum.communityhealthtoolkit.org/u/Pawan_KB)\ **Post date:** [September 9, 2026, 10:01am UTC](https://forum.communityhealthtoolkit.org/t/making-cht-app-more-secure-as-part-of-privacy-and-data-security/5735/1 "2026-09-09T10:01:51Z")
## **The present situation** Health workers using our CHIS app log in once, with a username and password, on the day the app is set up. After that the app stays logged in until someone logs out. In practice, nobody logs out. The session simply never ends. This is a documented CHT design choice, and it exists for good reasons. CHT is offline-first. Health workers work where there is no network for hours at a time, and forcing a re-login means making work more hectic. But it creates a gap. Our health workers use both facility phones/tablets and their own personal phones. Anyone who picks up that device — a colleague at the health post who is not an authorised user, a family member at home, a friend borrowing the phone — is already inside the app. No password, no barrier. One tap on the icon and they can browse household profiles and access to personal information of clients already in CHT.. ## **Why a device PIN/Pattern does not solve it** - **Facility devices are shared by design.** If a health post tablet has a PIN, everyone at that facility knows it — including staff who are not CHT users. - **A device lock protects the phone, not the app.** Once a health worker unlocks her own phone, every app on it is open. - **Family members usually know the phone PIN.** In our context it is shared knowledge, not a secret. Device security and application security answer different questions. ## **What is at risk** Through the Family Health Profile and routine CHIS workflows, the app holds names, ages, household location with GPS, pregnancy and postnatal status, family planning method, child immunisation and nutrition status, chronic conditions, referrals and phone numbers. In a village, It can cause social harm to the families who trusted a health worker with it. The app stays logged in is hard to defend as a reasonable measure. Also they are using their personal device to provide care and service using CHT. ## **What we are asking for** An **app-level lock** in the CHT Core Framework, of the kind WhatsApp, banking apps we already use: - The app locks itself after a configurable period of inactivity, or when sent to the background. - The user reopens it with a short PIN kept for CHT. - After repeated wrong attempts, fall back to normal username and password login. ## **Why now** We are scaling CHT in various region. Every scale-up puts more devices carrying identifiable household health records into private homes. What is manageable at pilot scale becomes a systemic exposure at provincial scale — and every CHT deployment running on shared or personal devices has the same problem. When a partner organization or the government implementer asks whether someone else can open this app, our honest answer today is yes. An app lock would change that answer, and it is not a large or exotic feature to build. @nitin @binod @kunwarl@Bhishan_KC @Min @narayan ---
**Author:** ![binod](https://communityhealthtoolkit.b-cdn.net/user_avatar/forum.communityhealthtoolkit.org/binod/32/60_2.png) [@binod](https://forum.communityhealthtoolkit.org/u/binod)\ **Post date:** [October 14, 2026, 11:14pm UTC](https://forum.communityhealthtoolkit.org/t/making-cht-app-more-secure-as-part-of-privacy-and-data-security/5735/2 "2026-10-14T23:14:59Z")
Thanks for writing this up, Pawan. This has been on GitHub for a long time: > > > Implement a PIN (or similar) to unlock access to the app when bringing the app b…ack to the forground. This will help protect when a phone is borrowed or stolen. > > \[More information\](https://docs.google.com/document/d/1VXM8KIJnBBGMVP4O9\_IrelBTAUu\_6DAqF6n-Ey\_9XQQ/edit) It asks for exactly this, a PIN (or similar) to unlock the app when it comes back to the foreground, to protect data when a phone is borrowed or stolen. It was opened in 2017, a prototype lock screen was built and later removed while waiting for design input. It was last discussed in 2020. It is still open, so it would be a good place to track this request. Alongside the PIN we can also offer biometrics, especially fingerprint, on phones that have a sensor. It is more convenient than typing a PIN several times a day, and it is also more secure: a fingerprint cannot be watched over a shoulder or shared the way a PIN can. The PIN would stay as the fallback for phones without a sensor or when the fingerprint is not recognised.