[Paper Review] Secure and Trustable Electronic Medical Records Sharing using Blockchain

Alevtina Dubovitskaya, Zhigang Xu+3 more|arXiv (Cornell University)|Aug 2, 2017

Blockchain Technology Applications and Security14 references389 citations

TL;DR

The paper proposes a permissioned blockchain framework with off-chain encrypted EMR storage for secure, private, and auditable sharing of electronic medical records, demonstrated via a radiation oncology prototype.

ABSTRACT

Electronic medical records (EMRs) are critical, highly sensitive private information in healthcare, and need to be frequently shared among peers. Blockchain provides a shared, immutable and transparent history of all the transactions to build applications with trust, accountability and transparency. This provides a unique opportunity to develop a secure and trustable EMR data management and sharing system using blockchain. In this paper, we present our perspectives on blockchain based healthcare data management, in particular, for EMR data sharing between healthcare providers and for research studies. We propose a framework on managing and sharing EMR data for cancer patient care. In collaboration with Stony Brook University Hospital, we implemented our framework in a prototype that ensures privacy, security, availability, and fine-grained access control over EMR data. The proposed work can significantly reduce the turnaround time for EMR sharing, improve decision making for medical care, and reduce the overall cost

Motivation & Objective

• Motivate secure, auditable sharing of EMRs among multiple healthcare actors while preserving patient privacy and consent.
• Propose a blockchain-based framework for managing and sharing EMR data in cancer care.
• Develop a practical prototype in collaboration with a hospital to validate privacy, security, availability, and fine-grained access control.

Proposed method

• Use a permissioned blockchain (Hyperledger-like) to store metadata and enforce access control via chaincode.
• Store EMR data off-chain in encrypted form (local hospital databases and cloud storage) with patient-controlled keys.
• Implement PBFT consensus among a small set of validated nodes and a membership service to manage identities.
• Enable fine-grained, time-bound permissions and data sharing via chaincode logic and patient-defined policies.
• Incorporate cryptographic techniques including digital signatures, hashing for integrity, and proxy re-encryption for key rotation and recovery.
• Describe data structures for patient metadata and permissions, and implement a prototype in radiation oncology to manage consent and data sharing.

Experimental results

Research questions

• RQ1 How can blockchain-based systems provide verifiable, immutable records of EMR access and sharing events?
• RQ2 Can a permissioned blockchain with off-chain storage meet privacy, security, and availability requirements for EMR sharing in clinical practice?
• RQ3 What is a feasible architecture and data model to support fine-grained access control and consent management for oncology care?
• RQ4 Does the proposed prototype improve data sharing speed and coordination among providers while preserving patient privacy?

Key findings

• A prototype framework demonstrates privacy, security, and availability for EMR sharing with fine-grained access control.
• Off-chain cloud storage combined with on-chain metadata and permissions enables efficient data sharing.
• The system uses enrollment and role-based APIs with chaincode to enforce access policies and data integrity.
• Patient-controlled keys and proxy re-encryption support robust recovery and key management in case of credential loss.
• PBFT-based consensus on a small network provides a scalable approach suitable for hospital-level deployment, with notes on potential scalability challenges.