Blockchain Smart Contracts for Policy Compliance: A Healthcare Perspective

Access to an electronic health record (EHR) is very heavily regulated through many different types of policies: federal-level policies, state-level statutes, and even local and organizational-level policies, which may, for example, include procedures to follow at the organization level to ensure compliance with other policies. In addition, individual patients can also establish agreements with their healthcare providers to express their consent related to access to or sharing their protected health records. When such policies are adequately specified and implemented, they go a long way toward protecting EHR data. However, research has shown that there are often significant problems or gaps in policy compliance that are not identified until after a breach. Further, a recent study shows that subcultures within a healthcare organization influence whether employees violate policies, perhaps unintentionally. These observations motivate us to revisit the compliance and provenance aspects of policies. This paper proposes a blockchain-powered contract-based access control model for enforcing patient-provider agreements (PPAs) and other applicable policies and attributes for policy compliance and provenance in the healthcare sector. Blockchain smart contracts appear to be a promising new technology that can potentially ensure that policies are enforced. In addition, the immutable storage property of blockchains and strong integrity guarantees give hope that an adequate trail for policy compliance (or non-compliance) can be maintained, thus facilitating provenance. The average PPA integrity writing cost for the deployed smart contract is 0.00059 Ether (1.06666 USD). The average reading time is 0.152864 seconds to verify PPA integrity on the blockchain network. Writing gas consumption and reading time are feasible for the proposed approach.