The growing use of mobile health (mHealth) technologies adds complexity and risk to the healthcare environment. This paper presents a multi-layered cybersecurity assessment of an in-house mHealth platform (PHGL-COVID), comprising a Docker-based server infrastructure, a Samsung Galaxy A55 smartphone, and a Galaxy Watch 7 wearable. The objective was to identify vulnerabilities across the server, mobile, and wearable components by emulating real-world attacks and conducting systematic penetration tests on each layer. Tools and methods specifically tailored to each technology were applied, revealing exploitable configurations, insecure Bluetooth Low Energy (BLE) communications, and exposure of Personal Health Records (PHRs). Key findings included incomplete container isolation, BLE metadata leakage, and persistent abuse of Android privacy permissions. This work delivers both a set of actionable recommendations for developers and system architects to strengthen the security of mHealth platforms, and a reproducible audit methodology that has been validated in a real-world deployment, effectively bridging the gap between theoretical threat models and practical cybersecurity practices in healthcare systems.

The growing use of mobile health (mHealth) technologies adds complexity and risk to the healthcare environment. This paper proposes a multi-layered assessment of cybersecurity of an in-house mHealth platform (PHGL-COVID), which consists of a Docker-based server infrastructure, a Samsung Galaxy A55 smartphone, and a Galaxy Watch 7 wearable. The goal of the work was to perform an assessment of cybersecurity vulnerabilities across the server, mobile, and wearable components of the mHealth platform by emulating real-world attacks and performing systematic penetration tests on all three layers of security. Each layer was examined using tools and methods specifically designed to assess the server, mobile, and wearable technologies. This analysis uncovered exploitable configurations, insecure Bluetooth Low Energy (BLE) communications, and leaks of Personal Health Records (PHR). The findings found systemic weaknesses including incomplete isolation of a container, leak of BLE meta-data, and the perpetual abuse of privacy permissions by Android applications. This study proposes practical recommendations, for developers and system architects, to help secure mHealth platform services. This study provides reproducible audit methodology, as well as a case study that is realized in real-world operational deployments, thus closing a gap between theorized models and practical security in healthcare.