Applications used across healthcare can request access to sensitive information and introduce software dependencies that need review. MobSTR helps information governance, data protection and security teams assess mobile apps, browser extensions and third-party Microsoft Teams apps, so approval decisions can be supported by clearer security and privacy evidence.
A PRACTICAL APPROVAL WORKFLOW
Move from an app request to a decision you can explain.
An application review is most useful when technical findings are considered alongside the work the application supports, the information it can access and the action your organisation will take.
- Identify the application and intended use. Record the app, browser extension or Teams app, who needs it and the clinical, administrative or business process it supports.
- Review the evidence. Examine vulnerabilities, permissions, software dependencies, data handling and privacy-policy findings that may need investigation.
- Decide in context. Consider the sensitivity of the information, the importance of the service and whether approval, restriction, mitigation or further supplier evidence is appropriate.
- Keep the decision current. Revisit the assessment when the application, its policy or its use changes.
SECURITY AND PRIVACY EVIDENCE
Bring more of the application estate into view.
MobSTR’s mobile application assessment and monitoring brings together code, permissions, dependencies, findings and review history. Browser extension risk assessment supports the Chrome and Microsoft Edge extensions used across the organisation.
OpenGates assesses third-party Microsoft Teams apps, including permissions, configured domains and security findings. InterroPol adds privacy-policy summaries, red flags and claim evidence so privacy questions can be considered alongside the technical assessment.
ONGOING REVIEW
Reassess applications as they change.
A one-off assessment records a point in time. MobSTR rescans applications and notifies teams when risk changes, helping reviewers revisit approvals, investigate new findings and maintain a clearer record of oversight.
Findings still need professional interpretation. An alert does not determine the decision on its own; it identifies evidence for the organisation to review against its use of the application.
NHS ASSURANCE CONTEXT
Use application evidence within wider assurance work.
NHS England’s CAF aligned Data Security and Protection Toolkit guidance covers managing risk, protecting against cyber attacks and data breaches, detecting events, minimising incident impact, and using and sharing information appropriately. Application assessment records can contribute evidence to that wider programme where they relate to the organisation’s essential functions, systems and suppliers.
Scope matters. MobSTR provides application risk evidence. It does not complete an organisational DSPT assessment, establish clinical safety or medical device conformity, or replace a DTAC assessment.
Read how MobSTR evidence relates to NHS DSPT and the NCSC CAF, including the limits of that mapping. For the source requirements, see NHS England’s CAF aligned DSPT guidance .
CUSTOMER EVIDENCE
Application review in practice at Bradford District Care NHS Foundation Trust.
MobSTR and Bradford District Care NHS Foundation Trust jointly won Cyber security solution of the year at the Health Tech Awards 2026. The published award story explains how automated analysis helps the Trust assess mobile applications and browser extensions, bringing evidence about permissions, data handling, encryption, dependencies and known vulnerabilities into a repeatable review.
Read the Bradford District Care NHS Foundation Trust and MobSTR award story.
DISCUSS YOUR PROCESS
See how an application review could work for your NHS organisation.
Bring a current approval question, an application list or the review process your team wants to improve. We will show you how MobSTR organises the evidence and supports continuing oversight.