Centralized management of medical data is the current solution in healthcare systems, however it suffers from some issues, mainly related to limited patient control, not mentioning the typical server based weaknesses, such as single point of failure high exposure to data breaches. Decentralized alternatives that combine distributed storage with blockchain based governance are a possible direction, but enforcing meaningful revocation of access once data has been shared remains difficult. This paper presents and compares two smart contract approaches for patient-controlled access to medical records. Both follow an off-chain/on-chain separation in which patient data resides on IPFS while the blockchain maintains only time bounded access grants, and an immutable audit trail. The baseline solution relies on a single shared identifier per patient and supports only logical revocation, which leaves previously shared content forever reachable. The proposed approach binds each authorization to a distinct identifier and introduces an off-chain Patient Agent that withdraws the corresponding copy upon revocation, providing availability-based revocation under an honest-but-curious threat model. We evaluate both designs in terms of on-chain cost and scalability, and compare their economic sustainability across a Layer-1 and a Layer-2 network.
A Smart Contract Architecture for Patient-Controlled Access to Medical Records
Franco, Francesco;Montagna, Sara;Bogliolo, Alessandro;Ferretti, Stefano;
2026
Abstract
Centralized management of medical data is the current solution in healthcare systems, however it suffers from some issues, mainly related to limited patient control, not mentioning the typical server based weaknesses, such as single point of failure high exposure to data breaches. Decentralized alternatives that combine distributed storage with blockchain based governance are a possible direction, but enforcing meaningful revocation of access once data has been shared remains difficult. This paper presents and compares two smart contract approaches for patient-controlled access to medical records. Both follow an off-chain/on-chain separation in which patient data resides on IPFS while the blockchain maintains only time bounded access grants, and an immutable audit trail. The baseline solution relies on a single shared identifier per patient and supports only logical revocation, which leaves previously shared content forever reachable. The proposed approach binds each authorization to a distinct identifier and introduces an off-chain Patient Agent that withdraws the corresponding copy upon revocation, providing availability-based revocation under an honest-but-curious threat model. We evaluate both designs in terms of on-chain cost and scalability, and compare their economic sustainability across a Layer-1 and a Layer-2 network.I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.
