Journal of Medical Internet Research - International Scientific Journal for Medical Research, Information and Communication on the Internet #Preprint #PeerReviewMe: Warning: This is a unreviewed preprint. Readers are warned that the document has not been peer-reviewed by expert/patient reviewers or an academic editor, may contain misleading claims, and is likely to undergo changes before final publication, if accepted, or may have been rejected/withdrawn. Readers with interest and expertise are encouraged to sign up as peer-reviewer, if the paper is within an open peer-review period. Please cite this preprint only for review purposes or for grant applications and CVs (if you are the author). Background: The importance of mobile apps is growing. Independent of the technologies used, mobile apps bring more functionality into the hands of users. In the health context, mobile apps play an important role in providing information and services to patients, offering healthcare professionals ways to monitor vital parameters or consult patients remotely. The importance of confidentiality in healthcare and the opaqueness of transport security in apps make the latter an important research subject. Objective: The objectives of this study were as follows: (1) identification of relevant security concerns on the server side of mobile apps, (2) testing a subset of mobile apps regarding their vulnerability to those concerns, and (3) comparing the servers used by mHealth apps with servers used in all domains. Methods: Server-Security characteristics relevant to the security of mHealth apps were assessed, presented, and discussed. To evaluate servers, appropriate tools were selected. Apps from the Android and iOS app stores were selected, tested and the results for functional and other backend servers evaluated. Results: The 60 apps tested communicate with 823 servers. Of these, 291 were categorized as functional backend servers and 44 (15%) of these received a rating below the A range (A+, A, and A-) by Qualys SSL Labs. A chi-square test was conducted against the number of servers receiving such ratings from SSL Pulse by Qualys SSL Labs. It was found that the tested servers from mHealth apps received significantly fewer ratings below the A range (P < 0.001). The internationally available apps from the test set performed significantly better than those only available in the German stores (α=0.05, p=0.03). A total of 28 (47%) of 60 apps were found using at least one functional backend server that received a rating below the A range from Qualys SSL Labs, endangering confidentiality, authenticity and integrity of the data displayed. The number of apps that utilized at least one entirely unsecured connection was 20 (33%) when communicating with functional backend servers. It was also found that a majority of apps used ad, tracking, or external content provider servers. When looking at all non-functional backend servers, 48 (80%) of the apps used at least one server that received a rating below the A range. Conclusions: The results show, that while servers in the mHealth domain perform significantly better regarding their security, there are still problems with the configuration of some. The most severe problems observed can expose patient communication with healthcare professionals, be exploited to display false or harmful information, or used to send data to an app facilitating further damage on the device. Following the recommendations for mHealth app developers the most regularly observed security issues can be avoided or mitigated.