The COVID-19 pandemic has highlighted the necessity for agile health services that enable reliable and secure information exchange, but achieving proper, private, and secure sharing of EMRs remains a challenge due to diverse data formats and fragmented records across multiple data silos, resulting in hindered coordination between healthcare teams, potential medical errors, and delays in patient care. While centralized EMR systems pose privacy risks and data format diversity complicates interoperability, blockchain technology offers a promising solution by providing decentralized storage, ensuring data integrity, enhancing access control, eliminating intermediaries, and increasing efficiency in healthcare. By focusing on a Brazilian case study, this paper explores the significance of EMR standards, security challenges, and blockchain-based approaches to promote interoperability and secure data sharing in the healthcare industry.@en

Cross-organisation data sharing is challenging because all the involved organisations must agree on ‘how’ and ‘why’ the data is processed. Due to a lack of transparency, the organisations need to trust that others comply with the agreements and regulations. We propose to exploit blockchain and smart contracts technologies to define an Attribute-Based Access Control System for cross-organisation medical records sharing, coined SmartAccess. SmartAccess offers joint agreement over access policies and dynamic access control besides blockchain transparency and auditability. We leverage the Attribute-Based Access Control model to implement smart contracts. We deploy and test them on a private and permissioned blockchain, transforming the access control process into a distributed smart contract execution. This paper proposes the SmartAccess system and its application in two healthcare use cases. We introduce the threat model and perform a security analysis of the system. To demonstrate the feasibility of our proposal, we implement a proof-of-concept of the smart contracts, written in Solidity language, with a size-efficient policy representation, and analyse the complexity and scalability of the contracts’ functions. Furthermore, we present performance results, measuring the latency and throughput of the transactions to execute the access control functions with different blockchain network consensus setups. We also compare the performance of the SmartAccess system against two open-source Solidity implementations of smart contract-based access control, Role-based Access Control and Access Control List. Finally, we discuss the strengths and drawbacks of our proposal. SmartAccess requires the overhead of a decentralised system, but the trade-off is transparency, regulation compliance and auditability for complex cross-organisation data sharing.@en

Acute stroke care demands fast procedures and collaboration of different healthcare organisations and professionals. The development of cloud computing and the wide adoption of electronic health records (EHR) foster healthcare systems to improve data availability and potentially enhance acute-stroke care quality. However, the design of a secure and privacy-preserving EHR cloud-based application is challenging. This paper presents the leading security and privacy requirements for healthcare applications and contextualises each requirement in the acute stroke care use case. Moreover, we deploy the ASCLEPIOS eHealth Cloud-based framework to address each requirement in designing an EHR cloud-based application for data sharing during acute stroke care. Our initial prototype combines the ASCLEPIOS framework with a public cloud service infrastructure and a private signature scheme. The prototype meets the security and privacy requirements since it protects the EHR data against unauthorised access, data breaches, and data exposure on public cloud providers. Moreover, we present preliminary results and discussions about the usability and overhead of the ASCLEPIOS framework. @en

For cross-sectoral sharing of health data, cloud services provide benefits regarding the availability of relevant information in critical situations. Nevertheless, storing electronic health records in the cloud may impact patient's privacy, since the cloud service provider might lack trustworthiness. Client-side cryptography mitigates the privacy risk by encrypting data in the user's computational environment before transmitting them to the cloud. However, client-side cryptography raises performance concerns. This paper investigates Web Assembly and JavaScript solutions that enable client-side cryptography in web applications and compares their performance against server-side cryptography. We contextualize the study within two healthcare web applications: a prototype for patient record sharing during acute stroke care and an application for sharing data in sleep medicine treatment. Our results show that JavaScript and Web Assembly libraries add more time to encryption and decryption than server-side cryptography. However, due to the concurrency introduced by simultaneous users, the performance of server-side cryptography is worse than client-side, taking longer times to attend to the demand and requiring a larger infrastructure to be effective. Moreover, the JavaScript library asmCrypto and Web Assembly approaches perform better than other libraries and are feasible candidates for application development.@en

Electronic medical records (EMRs) are highly sensitive information shared among peers to keep up-to-date patient history. Providing security, privacy, and availability to these sensitive data is a challenge because, typically, after data publication the patient loses control over them. In this paper, we propose a blockchain-based approach to secure EMR for healthcare applications, where access control is patient-centric. Our proposal keeps encrypted EMRs in the blockchain, and the patient shares the decryption key only with healthcare professionals in which he/she trusts. Blockchain allows untrusted node, in a distributed peer-to-peer network to correctly and verifiably interact with each other, without any reliable intermediary. We investigate the scalability of our approach through simulations. Results show that it scales well since increasing the number of nodes in the network implies a linear increase in the size of the stored chain. Results also reveal that the time for inserting a new EMR in the blockchain remains low even when the number of nodes in the network increases.@en

The blockchain is currently under the spotlight of trending technologies. It adds security to private applications in several areas of knowledge, and its versatility results in the development of multiple frameworks to meet the requirements of each application. Thus, it is a key challenge to ensure that blockchain frameworks provide security, access control, and high performance to applications. In this paper, we evaluate two frameworks for blockchain development, Parity, and Multichain, which provide configuration and permission flexibility. Our evaluation is a comprehensive comparison between the frameworks, focusing on the analysis of transaction-validation time, transaction-mining time, transaction-seek time and block-seek time. To this end, we deploy peer-to-peer private permissioned networks, in which the frameworks generate the blockchain applications. For each framework, we provide a realistic workload, based on the distribution of probability of interarrival time of transactions on the Bitcoin network. The results show that each framework stands out under specific criteria, and their design decisions imply restrictions on features that are critical for creating secure and efficient blockchain applications.@en