At a glance
- The problem
- Health information is spread across hospitals, laboratories, pharmacies and insurers. Patients and clinicians need to know that records are complete and unaltered, and who has accessed them.
- How a shared ledger helps
- A ledger can hold tamper-evident fingerprints of records, consent decisions and access logs, while the records themselves stay in protected hospital systems.
- Main limits
- Patient data must not be written to a ledger: it cannot be deleted, and even hashed or encrypted health data may still count as personal data under the GDPR. Integrating with hospital systems is the main cost.
The integrity problem in health data
A patient's history is usually split across many systems: a family doctor's practice, one or more hospitals, laboratories, imaging centres, pharmacies and insurers. Clinicians need to trust that what they see is complete and has not been changed. Patients want to know who has looked at their records. In disputes and investigations, it can matter a great deal whether an entry was written at the time of treatment or added later.
Hospital systems already keep audit logs for this reason. The difficulty is that the organisation running the system also controls its logs. A ledger shared with other parties, or anchored in a widely replicated network, can provide independent evidence that logs and records were not altered after the fact.
Keep the patient off the ledger
Health data is among the most sensitive categories of personal data. Under the EU General Data Protection Regulation it is a "special category" with extra protection, and individuals have rights to correction and, in some cases, erasure. Data written to a widely replicated ledger cannot practically be removed.
Hashing does not solve the problem on its own. If the input is short or predictable — a test result, a date, a patient number — an attacker can try likely values until a hash matches. Encrypted data may become readable in future if keys leak or algorithms weaken. European data protection authorities have therefore advised that personal data should, as a rule, not be stored on a blockchain, and that projects should assess carefully whether a ledger is needed at all.
The practical design principle is simple: medical records stay in protected systems; the ledger, if one is used, holds only salted fingerprints, pointers and event logs that reveal nothing about a person on their own.
Useful patterns
Integrity proofs for records
A hospital can regularly compute fingerprints of its records or audit logs and anchor them on a ledger. If a record is later altered, its fingerprint will no longer match the anchored value. This does not stop someone from changing data, but it makes undetected changes much harder.
Consent and access logs
Some projects record when a patient grants or withdraws consent for their data to be shared, for example with a research study, and when a party accesses data under that consent. A shared log lets the patient, the hospital and the researcher see the same history.
Medicine supply chains
Counterfeit and diverted medicines are a serious public-health risk. In the United States, the Drug Supply Chain Security Act requires an interoperable electronic system for tracing prescription medicines at package level. During the US Food and Drug Administration's pilot programme in 2019, some participants tested ledger-based approaches to exchanging that tracing information between manufacturers, wholesalers and pharmacies.
Research data provenance
Researchers can timestamp study protocols and analysis plans before data is collected, so others can verify later that the planned analysis was not changed after the results were known.
Practical obstacles
The largest cost is not the ledger but integration. Health systems use many different products and data formats; standards such as HL7 FHIR aim to make data exchangeable, and any ledger-based layer must fit around them. Governance is just as important: someone must decide who can join the network, who pays for it, and what happens when a participant leaves. Without clear answers, technically sound pilots tend to stall.
Before a project starts, its sponsors should be able to answer a few plain questions: which party needs evidence that it cannot obtain from the hospital's own audit logs; exactly what will be written to the ledger; how the data protection impact assessment deals with erasure and re-identification; and who will operate and pay for the network once pilot funding ends. Projects that cannot answer these questions clearly rarely move beyond the pilot stage.
Where it has been tried
Estonia has described using KSI, a hash-based integrity technology developed by the company Guardtime, to make changes to state registries — including health records — detectable. KSI records fingerprints of data, not the data itself, and is a permissioned system rather than a public cryptocurrency network.
MedRec, a research prototype presented by researchers at the MIT Media Lab in 2016, explored how a ledger could manage permissions and an audit trail for medical records held by different providers, without storing the records on the ledger.
In the United States, the FDA's 2019 pilot programme under the Drug Supply Chain Security Act included several projects that used ledgers to exchange product-tracing data between companies. These were time-limited pilots whose aim was to inform how the tracing requirements could be met.
When a database is enough
Within a single hospital or health system, signed audit logs, write-once storage and trusted timestamps (for example under the RFC 3161 protocol or qualified timestamps under EU law) provide strong integrity protection without a ledger. Interoperability standards and well-governed data-sharing agreements solve most problems of exchanging records between organisations.
A ledger may add value when several independent organisations need a shared, tamper-evident history of events — consent, access or product movements — and none of them is accepted as the sole keeper of that history. Patient data itself should still stay off the ledger.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation) — EUR-Lex
- European Data Protection Board, Guidelines 02/2025 on processing of personal data through blockchain technologies
- European Parliamentary Research Service, Blockchain and the General Data Protection Regulation (2019)
- Azaria, A., Ekblaw, A., Vieira, T. and Lippman, A., MedRec: Using Blockchain for Medical Data Access and Permission Management (2016)
- U.S. Food and Drug Administration — Drug Supply Chain Security Act resources
- HL7 FHIR specification
- e-Estonia
This explainer describes how a technology is used outside finance, for general education. It is not a recommendation to acquire, sell or hold any crypto-asset and is not financial or legal advice.