Status of this Document
This is a draft of the Emory Mobile Application Review Process. This document describes the process in use, but this process has not yet been documented. Once this document is finalized, it is anticipated that the Emory units involved in this process will meet to adjust and recommend a formal review process and present that to appropriate governance groups.
Step 1: Office of Technology Transfer Intellectual Property Analysis
Emory units desiring to release mobile applications should contact the Emory Office of Technology Transfer (OTT) for a review of the intellectual property and commercial prospects of the application. This process includes completion of an IP disclosure. In general, any application owned by Emory will be released under the Emory brand and through the Emory App Store or Marketplace accounts. There may be exceptions to this general rule in the case of collaborations between Emory and other partners or in a case where technology has been licensed to a third party. Typically, OTT will kick off this review process and coordinate the review with the other units listed in steps 2, 3, and 4 below. Panya Taysavang (firstname.lastname@example.org) is the primary contact with OTT.
Step 2: Communications & Marketing Branding Review
Mobile applications that are to be released under the Emory brand undergo a branding review with Communications & Marketing. Communications & Marketing will be preparing a set of written guidelines and resources for the proper branding of Emory mobile applications. Stanis Kodman (email@example.com) is the point of contact with Communications & Marketing.
Step 3: Legal Counsel Review
Step 4: Library and Information Technology App Store Posting Review
Emory Library and Information Technology (LITS) performs a high-level technical review of the application to determine if there is a need for any detailed security and compliance reviews of the application. For example, if the application collects and stores ePHI, credit card information, or other compliance related data, Emory OIT will inform the owners of the application of relevant policies and any practices required by those policies. See the template for this cursory review. George Wang (firstname.lastname@example.org) is the contact person for the LITS posting review. LITS will create a copy of the review template specifically for the requested application review and ensure the application owners have access to the template to complete the information. LITS staff will help complete this template as needed.
Once this technical review is completed, Emory LITS will copy the appropriate marketplace submission templates for the application. There are two submission templates: one for the Apple App Store and one for Google Play. Each submission template has the list of relevant artifacts that must be assembled to submit an application to each marketplace. Application owners will complete these templates and append all images and files to the template. Once the template is complete, LITS staff will submit the application with the appropriate marketplaces.
The following are links to the Marketplace Submission Templates:
Subsequent App Update Submissions
For subsequent application updates, application owners should update the technical review template and if there are substantial changes, request another review. For example, if the nature of the data being collected or stored by the application has changed and now ePHI is being collected when it was not before, then a new review should be scheduled. Application owners should also update the marketplace submission forms relevant to their applications for each subsequent submission.
Mobile and Mobile Web Application Initiative Inventory
Emory is presently exploring options for an internal mobile app store and registry. In the interim, a list of known Emory mobile applications serves this purpose.