Implementation Considerations for Blockchain in Healthcare Institutions

Ketan Paranjape,¹ Mitchell Parker,² David Houlding,³ Dr. Josip Car⁴

Objective: This article aims to provide a primer on blockchain technology and implementation considerations for blockchain at healthcare institutions.

Results: After research and interviews, we developed a primer and a high-level implementation guide for healthcare systems exploring the use of blockchain technology.

Conclusions: The use of blockchain technology in health care is at a promising stage in development but blockchain-based applications are yet to be demonstrated as a viable platform for exchanging and reviewing information. Healthcare systems should be cautiously optimistic regarding the potential of blockchain and do a thorough business and technical diligence that is driven by targeted use cases to be successful.

Health care is undergoing a transformation worldwide.¹ In many developed countries, mature but antiquated national healthcare services are burdened by an aging population, payment reforms, worker shortages, and rising costs.² The emergence of innovative technologies like artificial intelligence (AI),³ however, has made many healthcare systems optimistic about solutions and ready and eager for change. Another key technology leading this trend is blockchain,⁴ which can help healthcare providers automate medical record mining to aid in making more accurate diagnoses⁵ or reduce medical errors⁶ by enabling more accurate and tailored treatment, while simultaneously reducing the financial burden.

After success in industries like financial services⁷ and retail,⁸ if blockchain can be scaled and moved into mainstream health care, it can help alleviate many concerns over security and privacy of health data and help stitch together a longitudinal history of health data that are fragmented and locked away in disparate locations in the healthcare system today.

Sophisticated use of blockchain technology will contribute to improved health outcomes, improved healthcare quality, and lower health care costs—the three overarching aims that the United States is striving to achieve (improving care, improving health, and reducing costs).⁹

BLOCKCHAIN

Blockchain is a foundational platform to keep secure data in a distributed, encrypted, shared ledger and control access to that data. Blockchain technology is based on distributed ledger technology^{10,11,12,13,14} (DLT), which is a type of secure database that is implemented among a group of participants, without a central authority or administration. Members or contributors can create, modify, or remove transactions in the database by observing rules that are enforced by the ledger. For example, the ledger may ensure that you cannot spend money you do not have.

Immutability¹⁵ is an important aspect of blockchain for building trust and protecting the integrity of data stored on the blockchain. Once data are stored on the blockchain, it cannot be changed. Modifications and deletions can be accomplished through appending new records to the blockchain that supersede the originals. However, the older records on the blockchain remain intact. Distributed ledgers are used for building a broad class of applications and services like secure, robust cryptocurrencies (e.g., Bitcoin); for providing verifiable ownership of assets; and for managing access rights to personal data. These services can be provided without the requirement that a single organization be trusted with the data.

Another important consideration is ownership of assets. This is accomplished by digital keys, addresses, and digital signatures. A pair of digital keys are generated at a time—one public and one private.¹⁶ Comparing this to a bank account, the public key is the bank account and the private key is the secret Personal Identification Number (PIN) to access that account. The address is similar to the bank routing number that can be shared with anyone wanting to send money to you. Finally, the digital signature is like a real signature and is used to prove one’s identity, except that blockchain uses cryptography, which is more secure than hand signatures that can be easily forged.

BUILDING SECURE, ACCESSIBLE, AND LONGITUDINAL PATIENT RECORDS USING BLOCKCHAIN

Today’s patients demand a more personalized,¹⁷ seamless, and coordinated approach to their care, where providers amalgamate health data from multiple different siloed data sources (e.g., medical records, payer systems, genomics, clinical trials, and government sites) to come up with a diagnosis. Unfortunately, two major issues limit this approach: significant security and privacy concerns¹⁸ that impede sharing of health records, and the fact that patients interact with a large number of healthcare providers, leaving a scattered trail of information.¹⁹

Much of the apprehension surrounding data security and patient privacy is fueled by recent high-profile security breaches in patient healthcare records. A recent study revealed that healthcare data breaches are rapidly growing in scale and impact to healthcare institution and patients.²⁰ The primary concern of patients is that they have little or no control over their information after it has been provided to a payer, provider, or healthcare exchange. Patients want greater insight into how their data are used, who has access to it, and when it is being modified.²¹

To complicate matters, patients have medical histories from a variety of caregivers, such as a pediatrician, a university physician, a dentist, an employer health plan provider, or a medical specialist. Over the years, they leave data scattered across many healthcare systems that lock them away in silos.²² The result is a trail of health records that are hard to collect, are difficult to piece together, and are under primary ownership of the healthcare provider.²³ Table 1 summarizes the other pain points in health care today and how blockchain technology can be applied.

Table 1. Summary of healthcare pain points and potential blockchain opportunities

DLT: distributed ledger technology.

Blockchain applications²⁴ offer opportunities to address privacy and security concerns and bring together a longitudinal patient record from the patient’s perspective. A key benefit of using blockchain is that it can be used to empower patient to control access their health records. The patient can now give permission to their clinician to review their health record; grant access to another clinician for a second opinion; or provide read-only access to a guardian, doctor, pharmacy, insurance company, as needed via their private key. A subset of the patient data (metadata) that is represented in formats like the Continuity of Care Document (CCD) can be stored on the blockchain together with a link to the actual data location, and a hash code can be used to verify the integrity of the record stored off the blockchain. In this way, only minimal but sufficient (for the defined use case) Personally Identifiable Information (PII) and Protected Healthcare Information (PHI)²⁵ need be stored on the blockchain. The bulk of the PII and PHI can remain in the secure enterprise systems where they currently reside.

In this manner, blockchain can facilitate discovery of information about a patient, and actual records may subsequently be securely exchanged via secure, direct (i.e., not via blockchain), peer-to-peer communications between the sending and receiving healthcare organizations. Confidentiality of patient information can further be protected using private consortium blockchains, accessible only to well-known and highly trusted healthcare organizations that require access to it. Similarly, mechanisms like sidechains²⁶ that can allow tokens from one blockchain to be securely used in a separate blockchain can be used to isolate blockchains. Last, but not least, information on the blockchain can be encrypted to protect data confidentiality. Public Key Infrastructure (PKI) asymmetric encryption techniques can be used to empower patients with their private key and the ability to authorize access and use of their healthcare information. Individuals are granted access using smart contracts.²⁷ This is accomplished when certain conditions listed by the patient are met (see Figure 1).

Figure 1—Example of blockchain ecosystem in health care²⁸.

Blockchain provides the structure for health data that enables it to be analyzed but remain private. Taking advantage of the pseudonymous²⁹ nature (i.e., coded to a digital address rather than to a patient name) of blockchain technology and its privacy, personal health records could be linked securely through the blockchain.³⁰ Blockchain then provides a novel way to securely create a virtual lifelong longitudinal health record by storing encrypted access links to individual records from disparate health systems into a distributed ledger application and make the links accessible to authorized users.

Another important healthcare stakeholder, the payers (e.g., insurance companies, Centers of Medicare and Medicaid Services) also recognize the potential of blockchain. Blockchain can help create and maintain an accurate, comprehensive, longitudinal and secure up-to-date view of patient revenue cycle and clearinghouse activities across the payer–provider network. This allows payers to reduce operational burden, quickly validate a claim, handle pre-authorizations, and develop more sensitive risk stratification practices. Change Healthcare validated this model with its purchase of the assets of PokitDok.³¹

Finally, to take blockchain mainstream in healthcare, multiple healthcare leaders (payers, providers, and diagnostics laboratory) are coming together to create a common data sharing platform called Synaptic Health Alliance.³²

CHALLENGES WITH BLOCKCHAIN

The use of blockchain technology in health care is at a promising stage in development, but blockchain-based applications have not yet been demonstrated as a viable platform for exchanging and reviewing information.

One key challenge with blockchain is the immutability¹⁵ of data (i.e., once data are entered, they cannot be removed). From trust building and anti-fraud perspectives, immutability has great value, but from a legal perspective it introduces challenges, especially in the context of data subject to “right to be forgotten” requirements—such as in the recently released General Data Protection Regulation (GDPR) rules³³—since PII on the blockchain cannot be erased. Blockchains can also introduce challenges with compliance where nodes span multiple regulatory or data protection law jurisdictions. Any data stored on the shared distributed ledger of the blockchain flow to each copy maintained consistently by each node of the blockchain, and this can introduce data sovereignty and trans-border data flow challenges.

A second challenge with blockchain relates to implementation.³⁴ For blockchain technology to succeed, it must be integrated with current healthcare applications and processes. Care delivery processes may need updating to make use of new capabilities enabled by blockchain, including those for new patient-centric use cases. In these types of use cases, patients could gain more control over who has access to their health records, and the healthcare industry would have to enable this. Enabling patients to manage their healthcare data can be risky, and with multiple parties contributing, managing security keys could be difficult or prove impractical. Cybersecurity challenges with blockchain also remain prevalent.

Blockchain has significant features that strengthen security, in particular in the protection of data integrity with immutability, and improved protection of the availability of the network since blockchains are decentralized and have no single point of failure. However, protecting the availability of each blockchain node remains the responsibility of the associated healthcare organization, and this will become more critical as blockchains are used for mission critical healthcare services. Further, protecting the confidentiality of data stored on the blockchain remains the responsibility of the blockchain consortium of healthcare organizations. Fortunately, there are many well-established multi-layered, defense-in-depth strategies that can be employed to achieve effective security with blockchain.

There also remains a need for guiding principles and controls to establish security in the context of existing risk management programs. The white paper Advancing Blockchain Cybersecurity: Technical and Policy Considerations for the Financial Services Industry³⁵ by Microsoft illustrates eight core principles and controls needed to effectively implement security controls for permissioned blockchains.

CHECKLIST FOR BLOCKCHAIN IMPLEMENTATION

The Healthcare Information and Management Systems Society (HIMSS) Blockchain Work Group is in the process of identifying and analyzing business and technical factors that would facilitate blockchain implementation in healthcare.³⁶

The group has developed an initial checklist that healthcare institutions can use to help set up and/or augment their existing blockchain initiatives. Key activities on the business side include identifying use cases, business models, incentives and return on investment (ROI). Careful thought has to be given to privacy, security and compliance. The IT team will have to consider the right technology, architecture, along with performance, throughput and scalability implications. Finally, the institute will have to prototype and pilot the use cases with the ultimate goal of deploying a solution that can improve patient care.

CONCLUSIONS

The healthcare industry values many of the basic underlying tenets of blockchain technology, such as trusted execution, non-repudiation of data, auditable trails and records for transactions, full replications of data in a secure environment, consensus on data changes, and decentralization of authority/data. Blockchain technology holds high promise of being a widely adopted mechanism in the healthcare system for resolving issues that have long concerned the industry.

At the same time, there are many areas of blockchain that are relatively untested in a healthcare environment, such as the need for a service level agreement, viability of privacy, scalability of a system to handle large numbers of participants, control and restrictions around access to patient data, and issues of patient record ownership.

Despite its tremendous potential, healthcare systems should be cautiously optimistic regarding blockchain technology and maintain a healthy skepticism toward the hype surrounding it today. As healthcare systems embark on securing and digitizing their infrastructure, they should focus on introducing novel clinical decision support systems using analytics and AI.

Blockchain shows great potential in providing a foundation to support and advance AI. As use cases for blockchain are identified that have compelling value to healthcare—from reducing cost to improving patient outcomes, engagement, and experiences—they can be prototyped with attention to privacy, security, and compliance from the start, and piloted with de-identified test data across consortiums of participating healthcare organizations to test, improve, and evolve the solutions for optimal effectiveness.

Funding Statement: The author(s) received no financial support for the research, authorship, and/or publication of this article.

Conflict of Interest: None of the authors declare any conflicts of interest.

Contributors’ Contributions: Each author contributed to the conception, writing, and revisions of the article.

REFERENCES

Copyright Ownership: This is an open access article distributed in accordance with the Creative Commons Attribution Non Commercial (CC BY-NC 4.0) license, which permits others to distribute, adapt, enhance this work non-commercially, and license their derivative works on different terms, provided the original work is properly cited and the use is non-commercial. See: http://creativecommons.org/licenses/by-nc/4.0.