Secure Health Information System With Blockchain Technology
Secure Health Information System With Blockchain Technology
Nigerian Society
of Physical
J. Nig. Soc. Phys. Sci. 5 (2023) 992
Sciences
Abstract
This paper focuses on highlighting the problems that are associated with the absence of privacy and security of medical records in a healthcare
system. It seeks to bridge the gap between the currently used security protocols in the management of health information, and encryption
algorithms that should be used. Extant health information systems have always been developed with conventional databases. With all the
privileges to read, write and execute assigned to the administrator, who has centralised control over all medical records, there is the likelihood of
the misuse, distortion and loss of such records in the event that the administrator becomes compromised or inadvertent system failure. To solve
this problem, the use of decentralised and distributed databases becomes paramount. Blockchain technology has recently received much attention
due to its ability to permit a peer-to-peer network with distributed databases that can be stored locally on each node in the network. Subsequently,
all updates on records in a database are communicated to all participating parties, hence addressing the problem of centralised control. In this
paper, we propose a health information system on a blockchain to create a trust-free system for both health personnel and patients. From the
results obtained, we achieved the decentralisation of the medical records’ database to enhance the security and privacy of data on the modeled
peer-to-peer network.
DOI:10.46481/jnsps.2023.992
Keywords: blockchain, health information system, distributed databases, encryption algorithms, medical records
Article History :
Received: 16 August 2022
Received in revised form: 06 November 2022
Accepted for publication: 06 November 2022
Published: 29 April 2023
© 2023 The Author(s). Published by the Nigerian Society of Physical Sciences under the terms of the Creative Commons Attribution 4.0 International license
(https://creativecommons.org/licenses/by/4.0). Further distribution of this work must maintain attribution to the author(s) and the published article’s title, journal citation, and DOI.
Communicated by: Tolulope Latunde (Ph.D.)
the storage and retrieval of medical records. According to and other health personnel. In addition, patients’ past illnesses,
[2–4], a typical HIS must allow for the effective collection, which are recorded on the blockchain can be useful for the
processing, reporting, and use of health-related data across proper treatment of patients in contrast to systems that run on a
different health-based units. Current approaches to health centralised database with limited access and the possibility of
information systems rely mostly on centralised databases with central point of failure.
administrative control and policies, as well as authoritative
access. In this case, changes and updates are only effected by To address the problem of authoritative access and cen-
an administrator or super user, and any other person to which tralised control of the database of medical records, this paper
such rights and privileges are assigned. This nontransparent proposes a secure system for managing medical records using
transaction policy creates room for the possibility to distort the blockchain technology. The use of the blockchain provides
records and compromise the integrity of classified medical data. distributed access to the database of medical records to forestall
the problem of single pint of failure. In the same sense, it be-
In recent times, the emergence of disruptive technologies comes impossible to modify the stored medical records without
such as the blockchain provides the capacity of managing the consensus of the participating parties, thus making the stor-
distributed databases, which can be updated and locally age and transmission of medical records an entirely transparent
stored across all nodes in the network. According to [5], process. To implement the blockchain, we used Python, GO,
the blockchain is a distributed database of records (or public Docker Engine, interplanetary file system (IPFS), and other
ledger) of all transactions, which are executed and shared technologies with significant results obtained from rigorous ex-
among participating parties. Similarly, [6] argued that in a perimentation. The rest of the paper is organised as follows; the
blockchain, transparency is inherent, thus, permitting that review of the related literature is discussed in section 2. In sec-
updates on records are only possible when a majority of tion 3, the materials and method are discussed while the results
the participants reach a consensus. New insights into the and discussion are presented in section 4. Finally, the conclu-
expansion of HIS show that it has the potentials to increase sion with future research direction is given in section 5.
the accessibility to medical records [7–9]. However, the use of
conventional and centralised databases limit such possibilities 2. Review of Related Literature
as authentication credentials are granted from a central point.
In the event of a failure of the database, loss of records becomes A detailed analysis of the existing healthcare information
inevitable, in which case, the operations of the target system systems is provided in [12]. The authors argued that comput-
will be truncated in real time. These limitations necessitate the erisation is significant in realising an efficient HIS. Similarly,
need for a decentralised database that is difficult to compromise they investigated the security of medical records and were
in terms of data integrity, confidentiality and availability. able to give the design of a computerised system used by the
National Heath Management Information System (NHMIS).
Current implementations of the blockchain enable the use The implemented system was able to allow the safekeeping of
of a public ledger, which consists of the information of all the patients’ records with basic components of running an effective
participants and transactions on the blockchain [6–10]. The and productive hospital. This notwithstanding, the system ran
information captured as well as the digital transactions that on a local server database that served as the repository for all
have ever been executed on the blockchain can be recorded and medical data including queries and reports.
shared across the peer-to-peer blockchain network. Similarly,
[11] asserted that users can validate transactions, and also have In [4], the evolution of HIS is highlighted. Areas of interest
identical copies of these transactions on their local machines. include the migration from paper-based to computer-based pro-
In this way, health information can be securely stored, updated cessing and storage, the availability of global and regional HIS,
and transmitted without unauthorised modification. Further- the use of health-related data for effective healthcare planning,
more, it is easier to track all updates as the information stored and the deployment of technology for health monitoring. These
in the blockchain database is always complete and includes aspects of HISs have witnessed tremendous improvements
all records of transactions from the point of origin of the alongside an increase in health-related data. It is therefore
transactions. pertinent to have a robust mechanism through which the
escalating amount of medical records can be effectively stored,
Health information requires a high level of accuracy at all queried, reported and transmitted. Furthermore, [3] highlighted
times as minor changes in such data can lead to very unpleasant the design and implementation of a HIS, and discussed the
results with a plethora of consequences. With the blockchain possibilities of improving its structure through the use of a
network being able to perform periodic self-updates, it helps comprehensive, integrated and decentralised system.
to deliver a self-reviewing system that is computationally
infeasible and expensive to compromise. Transactions stored Similarly, [13] assert that the tendency to manually rec-
cannot be erased without the consensus of all participating oncile medical data among clinics, hospitals, laboratories,
parties. In this sense, it will be feasible to store and track pharmacies and insurance companies has not been a successful
medical records irrespective of the location of the Health process. This is due to the fact that no single list of the
Maintenance Organisation (HMO), patients, nurses, doctors, disparate locations housing patients’ data exists, and at the
2
A. E. Ibor et al. / J. Nig. Soc. Phys. Sci. 5 (2023) 992 3
It is argued in [15] that the use of blockchain can be One significant feature of the blockchain remains that it
helpful to tackle the lagging in HIS, which runs on local server cannot be easily compromised [22]. When a block is cre-
databases. This is a fact as patients whose medical records ated, a one-time hash is generated. This hash is unique to the
are managed by HIS running on a local server database have blockchain and is generated using the values of the features of
limited privileges to such data. Consequently, the administrator each block. Changes to values in the block invalidate the hash
may alter these records or deny patients access to same. as well as the block making the blockchain unbreakable as il-
lustrated in Figure 1.
There are several attempts by malicious users to com-
promise the security of medical records. Cyberattacks such
as SQL injection [16], which targets the data aggregated on
the database over time are very common. To this effect, the
use of various disruptive technologies such as the blockchain,
artificial intelligence, and internet of things for protecting
medical records from human errors and cyberattacks is
discussed in [17]. The different application areas of these
technologies were also highlighted in this work including their
security-related concerns. Specifically, the authors identified
the use of blockchain-based trust models in the implementation Figure 1: An Illustration of the Blockchain
of data management in the healthcare sector to optimise the
process flow and reduce the operational costs. As shown in Figure 1, putting information in the blockchain
creates a block that contains the present and previous hashes.
The authors in [18] argued that the blockchain facilitates The first block is known as the genesis block, and has the
the use of a decentralised and distributed environment devoid present hash and previous hash. The second block is then
of a central authority. Since the transactions on a blockchain created and the hash of this block is linked with the genesis
are both secure and trustworthy, its use in healthcare for block, and so on.
realising patient-centric approach to healthcare systems and
maintaining accurate electronic healthcare records is cru- In this sense, [15] asserted that the use of blockchain inno-
cial. From their findings, the authors agreed that the use of vation allows a verified HIS to resolve certain issues, for ex-
blockchain technology in healthcare allows for the sharing of ample, moderate access to medical information, framework in-
data, the accurate management of health records, and access teroperability, improved quality of medical data, and trust-free
control. In the same sense, the use of lightweight blockchain transactions. In addition, the significant advantages of the usage
architecture for the management of healthcare data is proposed of blockchain in the security of medical records are highlighted
in [19]. The approach is able to reduce the computational and in [13, 22–25]. These include:
communication overhead of Bitcoin network using clusters, i. Distributed Database: Each patient on a blockchain can
where each copy of the ledger is maintained per cluster. access the entire database from its origin and be able to confirm
Each cluster consists of network participants that are able the records of his/her information or data straightforwardly,
to use canal for secure and confidential transactions. Their without a middle person.
approach was also targeted at eliminating the problems of ii. Peer-to-Peer Transmission: Communication happens le-
traditional client-server and cloud-based systems deployed in gitimately between nodes rather than through a focal hub. Ev-
managing healthcare data. Some of these problems include ery node stores and advances data to every other node.
single point of failure, centralised data control, inherent system iii. Transparency with Pseudonymity: Every transaction
vulnerabilities, and data privacy. and its related components are obvious to anybody with access
3
A. E. Ibor et al. / J. Nig. Soc. Phys. Sci. 5 (2023) 992 4
to the blockchain. Every node, or client, on the blockchain has the block of information holding the medical record is changed.
a unique identifier of 30 or more alphanumeric code that dis-
tinguishes it. Clients can stay unknown or give confirmation of The blockchain network is a decentralised structure with
their identities to other people. All transactions happen between peer-to-peer nodes. These nodes inspect and authenticate the
blockchain addresses. validity of any new transaction such as a storage or retrieval re-
iv. Irreversibility of Records: Once a transaction is entered quest. This request is then fulfilled though distributed consen-
in the database and the records are refreshed, the records sus by different validating nodes. Moreover, no single validat-
cannot be adjusted, in light of the fact that they are connected ing node can have centralised control of the blockchain, making
to each record that preceded them (subsequently the expression it difficult for medical records to be corrupted, distorted, stolen
”chain”). Different computational algorithms and methodolo- or compromised. The architecture of the proposed system is
gies are used to guarantee that the chronicle on the database is shown in Figure 2.
lasting, sequentially ordered, and accessible to all others on the
system.
is stored and recovered. Information in this tier is kept i. HTML: is the standard markup language for creating web
free of application servers or business logic. This layer pages. It describes the structure and elements of a web
was built on ganache, yarn and truffle (Ethereum Hyper- page.
ledger Smart Contracts). ii. CSS: It is a style sheet language used for describing the
presentation of a document written in a markup language
3.2. Activity Diagram like HTML.
An activity diagram represents a series of actions or flow of iii. JavaScript: JavaScript, often abbreviated as JS, is a high-
control in a system similar to flowchart or a data flow diagram level, interpreted programming language that conforms
[31]. The activities modeled can be sequential and concurrent. to the ECMAScript specification.
Figure 3 shows the activities performed by each entity/class of iv. Python: Python is an interpreted, high-level, general-
the system and these activities are discussed thus: purpose programming language. Python has a design
i. The health personnel and patient attempt to login by philosophy that emphasises code readability, notably us-
entering their respective usernames and passwords, and ing significant whitespace. It provides constructs that en-
await authorisation from the blockchain database. If the able clear programming on both small and large scales.
username and password is invalid it aborts the operation v. GO: Go is a statically typed, compiled programming lan-
but if valid the users (health personnel and patient) gains guage that is syntactically similar to C, but with memory
access into the system and are assigned individual privi- safety, garbage collection, structural typing, and CSP-
leges. style concurrency.
ii. The health personnel views patients’ medical history, di- vi. Yarn (extension yarn.lock): In order to get consistent in-
agnose, run tests on the patient and then upload the med- stalls across machines, Yarn needs more information than
ical results into the system. The blockchain encrypts the the dependencies you configure in your package.json .
medical result and shares to multiple participants in the Yarn needs to store exactly which versions of each de-
network for consensus. pendency were installed. To do this Yarn uses a yarn.lock
iii. The patient views the medical result uploaded by the file in the root of your project.
heath personnel and can request for modification in bio- vii. Docker Engine: It is the underlying client-server technol-
data. The request is sent to the blockchain database and ogy that builds and runs containers using Docker’s com-
propagated across the network for subsequent approval ponents and services. Docker Engine supports the tasks
or decline of the request. If the request is approved the and workflows involved to build, ship and run container-
changes are effected otherwise the operation is aborted. based applications.
One participant cannot make changes without the cosen- viii. Electron.js: Formerly known as Atom Shell is an open-
sus of other participants in the network, otherwise the source framework developed and maintained by GitHub.
data is said to be compromised. Electron allows for the development of desktop GUI ap-
plications using front and back end components origi-
nally developed for web applications: Node.js runtime
4. Experimental Results and Discussion for the backend and Chromium for the frontend. Electron
An implementation of the architecture of the proposed sys- is the main GUI framework behind several notable open-
tems is given in this section. Several experiments were con- source projects including Atom, Visual Studio Code, and
ducted to test the developed application for realising distributed Light Table.
access to medical data based on the design of Figures 2 and 3. ix. InterPlanetary File System (IPFS): InterPlanetary File
The application used is built using existing technologies such System (IPFS) is a protocol and network designed to cre-
as node.js, truffle smart contract, inter-planetary. ate a content-addressable, peer-to-peer method of stor-
ing and sharing hypermedia in a distributed file system.
4.1. Testbed of the Experiments IPFS is a peer-to-peer distributed file system that seeks
The proposed system was implemented on a Windows ma- to connect all computing devices with the same sys-
chine running Windows 10 64-bit operating system, x64-based tem of files. IPFS could be seen as a single BitTorrent
processor with 4GB RAM and Intel ® Core i3 6100U CPU swarm, exchanging objects within one Git repository. In
@2.30 GHz 2.30GHz. other words, IPFS provides a high-throughput, content-
addressed block storage model, with content-addressed
4.2. Software Components hyperlinks.
An implementation of the architecture of the proposed sys-
tems is given in this section. The software used is built us-
4.3. Results and Discussion
ing existing technologies such as node.js, truffle smart contract,
inter-planetary file system, Docker engine. With the implemen- This section discusses the results of the experiments
tation of the blockchain, medical records were cryptographi- conducted to validate the efficacy of the proposed system.
cally stored on a peer to peer network. The components used in At the initial stage, a folder is created and populated with
building the software are as follows: any category of health records either for the health personnel
5
A. E. Ibor et al. / J. Nig. Soc. Phys. Sci. 5 (2023) 992 6
In the next stage, files are added to the created and en-
crypted folders for each entity participating in the blockchain.
The added files are encrypted and hash values assigned to
them to protect the integrity of their contents. This process is Figure 9: Used space and Peers Connected to the Blockchain network
depicted in Figure 6.
blockchain is a public ledger that provides the information of [13] J. D. Halamka & A. Ekblaw, “The potential for blockchain to transform
all the participants and all digital transactions that have ever electronic health records”, Harvard Business Review 3 (2017) 2.
[14] A. Azaria, A. Ekblaw, T. Vieira, & A. Lippman, “Medrec: Using
been executed, it helps to negate the relevance of authoritative blockchain for medical data access and permission management”, In 2016
access to a database of medical data. In this sense, the proposed 2nd International Conference on Open and Big Data (OBD) (2016) 25.
system will bring about an accurate and efficient way of trans- [15] A. Ekblaw, A. Azaria, J. D. Halamka, & A. Lippman, “A Case Study
ferring medical records from health personnel to the patients for Blockchain in Healthcare:“MedRec” prototype for electronic health
records and medical research data”, In Proceedings of IEEE open & big
without instances of record manipulation. For future work, we data conference 13 (2016) 13.
intend to provide a large scale implementation of this work on [16] S. M. Shagari, D. Gabi, N. M. Dankolo, & N. N. Gana, “Countermeasure
a district-wide basis to ascertain its resilience in real time. to Structured Query Language Injection Attack for Web Applications us-
ing Hybrid Logistic Regression Technique”, Journal of the Nigerian So-
ciety of Physical Sciences 4 (2022) 832.
Acknowledgment [17] S. K. Jagatheesaperumal, P. Mishra, N. Moustafa, & R. Chauhan, “A
holistic survey on the use of emerging technologies to provision secure
healthcare solutions”, Computers and Electrical Engineering 99 (2022)
The authors appreciate the handling editor and the reviewers 107691.
for their valuable comments that improved the quality of this [18] M. Hölbl, M. Kompara, A. Kamisalic, & L. Nemec Zlatolas, “A system-
paper. atic review of the use of blockchain in healthcare”, Symmetry 10 (2018)
470.
[19] L. Ismail, H. Materwala, & S. Zeadally, “Lightweight blockchain for
References healthcare”, IEEE Access, 7 (2019) 149935.
[20] T. McGhin, K. K. R. Choo, C. Z. Liu, & D. He, “Blockchain in healthcare
[1] K. A. Wager, F. W. Lee, & J. P. Glaser, Health care information systems: applications: Research challenges and opportunities”, Journal of Network
a practical approach for health care management, John Wiley & Sons, and Computer Applications 135 (2019) 62.
(2017). [21] A. Hasselgren, K. Kralevska, D. Gligoroski, S. A. Pedersen, & A. Fax-
[2] B. Chaudhry, J. Wang, S. Wu, M. Maglione, W. Mojica, E. Roth, ... & P. vaag, “Blockchain in healthcare and health sciences—A scoping review”,
G. Shekelle, “Systematic review: impact of health information technol- International Journal of Medical Informatics, 134 (2020) 104040.
ogy on quality, efficiency, and costs of medical care”, Annals of internal [22] D. Efanov & P. Roschin, “The all-pervasiveness of the blockchain tech-
medicine 144 (2006) 742. nology”, Procedia computer science 123 (2018) 116.
[3] C. N. Chaulagai, C. M. Moyo, J. Koot, H. B. Moyo, T. C. Sambakunsi, [23] A. Dubovitskaya, Z. Xu, S. Ryu, M. Schumacher, & F. Wang, “Secure and
F. M. Khunga, & P. D. Naphini, “Design and implementation of a health trustable electronic medical records sharing using blockchain”, In AMIA
management information system in Malawi: issues, innovations and re- Annual Symposium Proceedings American Medical Informatics Associ-
sults”, Health policy and planning 20 (2005) 375. ation 2017 (2017) 650.
[4] R. Haux, “Health information systems–past, present, future”, Interna- [24] S. Angraal, H. M. Krumholz, & W. L. Schulz, “Blockchain
tional journal of medical informatics 75 (2006) 268. technology: applications in health care”, Circulation: Car-
[5] M. Crosby, P. Pattanayak, S. Verma & V. Kalyanaraman, “Blockchain diovascular Quality and Outcomes 10 (2017) e003800,
technology: Beyond Bitcoin”, Applied Innovation 2 (2016) 71. https://doi.org/10.1161/CIRCOUTCOMES.117.003800.
[6] M. Iansiti & K. R. Lakhani, “The truth about blockchain”, Harvard Busi- [25] T. T. Kuo, H. E. Kim, & L. Ohno-Machado, “Blockchain distributed
ness Review 95 (2017) 118. ledger technologies for biomedicaland health care applications”, Journal
[7] J. Tan (Ed.), E-health care information systems: an introduction for stu- of the American Medical Informatics Association 24 (2017) 1211.
dents and professionals, John Wiley & Sons, (2005). [26] M. Wohrer & U. Zdun, “Smart contracts: security patterns in the ethereum
[8] L. Poissant, J. Pereira, R. Tamblyn, & Y. Kawasumi, “The impact of elec- ecosystem and solidity”, In 2018 International Workshop on Blockchain
tronic health records on time efficiency of physicians and nurses: a sys- Oriented Software Engineering (IWBOSE) 2018 (2018) 2.
tematic review”, Journal of the American Medical Informatics Associa- [27] P. McCorry, S. F. Shahandashti, & F. Hao, “A smart contract for board-
tion 12 (2005) 505. room voting with maximum voter privacy”, In International Conference
[9] R. Heeks, “Health information systems: Failure, success and improvisa- on Financial Cryptography and Data Security (2017) 357.
tion”, International journal of medical informatics 75 (2006) 125. [28] O. Ojo, M. K. Kareem, S. Odunuyi, & C. Ugwunna, “An Internet-of-
[10] G. Zyskind & O. Nathan, “Decentralizing privacy: Using blockchain to Things based Real-time Monitoring System for Smart Classroom”, Jour-
protect personal data”, In 2015 IEEE Security and Privacy Workshops nal of the Nigerian Society of Physical Sciences 4 (2022) 297.
(2015) 180. [29] X. Li, P. Jiang, T. Chen, X. Luo, & Q. Wen, “A survey on the security of
[11] A. E. Ibor, O. A. Ofem, & J. N. Obidinnu, “A Conceptual Framework blockchain systems”, Future Generation Computer Systems 107 (2020)
for Augmenting the Security of Digitized Academic Records in Nigerian 841.
Tertiary Institutions using Blockchain Technology”, International Journal [30] C. K. Frantz & M. Nowostawski, “From institutions to code: Towards
of Information Security, Privacy and Digital Forensics 2 (2018) 4. automated generation of smart contracts”, In 2016 IEEE 1st International
[12] O. J. Ayangbekun & O. E. Ameenah, “Comparative analysis of existing Workshops on Foundations and Applications of Self* Systems (FAS* W)
health information systems for the development of Nigerian health sec- (2016) 210.
tor”, International Journal of Innovative Research in Computer and Com- [31] J. Rumbaugh, I. Jacobson, & G. Booch, Unified modeling language ref-
munication Engineering 2 (2014) 4981. erence manual, Pearson Higher Education, (2004).