Blockchain Approaches to Data Privacy in Healthcare
Stephanie Perez, Associate Director at R3 — Partnerships and George Calle, Research Associate
Wendy Bohner, Intel Health & Life Science Solution Architect
Healthcare organizations across the world have increasingly adopted digital solutions for health record management with the goal of improving the quality, efficiency and transparency of the health care system. The growth of electronic medical data leads to artificial intelligence-based data analysis with the potential of expanding medical insights. However, the computerization of patient care does not come without drawbacks.
For example, digital systems create new burdens for doctors. Electronic Medical Record (EMR) system dictated workflows come at the expense of patient interactions. Additionally, digitizing the EMR introduces risk of cyberattacks breaching data security and thereby data privacy. Protecting personal privacy is critical to healthcare organizations maintaining patient trust. Regulations such as the Health Insurance Portability and Accountability Act (HIPAA) in the US and General Data Protection Regulation (GDPR) in the European Union were enacted to manage data privacy concerns.
Due to the tendency of hospitals to use proprietary systems, software innovations are isolated at the level of the organization. While a digital solution may enable individual hospitals with a more comprehensive view of their patients, the patients themselves still have little control over their data — and just like paper-based records, digital records can be wrong.
All this creates a tension in the healthcare industry. Providers, payers and researchers must be able to interact with patient data, while also protecting their patients’ privacy. Data security is a top-level concern that cuts across almost all healthcare use cases. Unfortunately, this often comes at the expense of efficient communication and information coordination between companies.
At first glance, public blockchains may seem like a good answer for healthcare because they require all entities on the network to all come to agreement on data and every node has the same record and history. However, the public ledger approach introduces new issues for data privacy.
Many blockchain platforms that publicly spread data by default now attempt to solve for privacy by retroactively adding layers to obfuscate private data. But if the different privacy layers don’t interoperate, all that’s been created are new silos of data — the exact problem blockchains promise to solve!
If we dare to envision a future of highly efficient value transfer between multiple stakeholders, such as pharmaceutical manufacturers, providers, payers and patients, privacy must be a core design decision.
Blockchain can be used for multiple healthcare use cases
Using a blockchain to enhance electronic Healthcare Information Exchange (HIE), would make data exchange across a broad number of healthcare applications faster, more cost–effective and transparent, while also providing services such as auditing.
Blockchains built with the correct architecture will be useful for recording and executing on consent-based patient data sharing. A patient may, for instance, opt-in to share data for purposes of medical research — but only specific aspects of their history, only on an anonymized basis and for a defined period.
Blockchain can also be used within the healthcare industry to accelerate claims approvals in an environment where stakeholders can communicate directly with each other. To do so, the blockchain must be built to allow for flexible data sharing where people are only communicating the necessary amount of information required — and nothing else.
Specifically, the “point to point” blockchain architecture allows entities to exchange data in such a flexible, yet private manner. Data within the blockchain travels directly from one party to another, which means only the parties involved in a transaction are involved in building, validating and storing it.
Coupling blockchain with Intel hardware-based security opens further opportunities
Even blockchains that maximize privacy through point to point data exchange assume that you are willing to permit your counterparty to have visibility into the data you send them.
However, there are times where you might need to send information to a computer for a specific purpose but need to ensure that the owner of the computer can’t see it. For instance, your child may need to provide verification of immunization to attend a camp, but you don’t necessarily want or need to share all the details of their medical history.
Using Intel Software Guard eXtensions (Intel® SGX), the ledger data can be encrypted, enabling data integrity to be checked within an enclave, where the data can remain private. SGX allows platforms, like R3’s Corda, to create a trusted space, or enclave, where memory encryption is used to isolate application-specified code and data. The secure features of Intel SGX enable Corda to protect sensitive patient data with hardware-based security.
Intel SGX can help facilitate flexible privacy on blockchains within the claims validation processes. At the network level, agreements are only seen by the transacting parties, while at the entity level, the patient can share only the parts of the patient record that are needed for each transaction.
R3’s Corda and Intel SGX can expand the amount of potential uses for blockchain in healthcare. Intel SGX permits an application developer to set up personal health information (PHI) as a private data object that can be accessed and updated exclusively through a predefined interface (composition of code & state) — that controls access to the patient data for the purposes of applying analytics. One potential use case would be a small data set of genomics that can identify the patient due to small data set size. Small data sets, that would not typically be usable because the patient could be identified, can be encrypted and shared to allow cancer computations to access protected data only while it is in the enclave. The results of the computations are shared, and the data is kept hidden and secure. Researchers are using Intel SGX to help with confidentiality of genomics data.
Ultimately, a blockchain can allow patients, practitioners, and insurance companies to utilize one, shared ledger to track patient medical record access and changes. All parties have increased confidence that data is accessed on a need to know basis and the information is up to date. As technologies develop, new opportunities will be realized to analyze information, make decisions and transact in ways that challenge our current trust assumptions.
Contact Wendy Bohner or Stephanie Perez if you are interested in proving the value of blockchain for your healthcare use case.
