The Most Significant Compliance Challenges for Blockchain in Healthcare

Let's assume for the next few minutes that we want to use blockchain technology to store and manage patient data (PHI).

This shouldn’t be too far-fetched. The majority of blockchain projects within healthcare today attempt to do just that.

Discussions about these projects often quickly lead to how successful they are based on the number of transactions they see or the value of their underlying token or cryptocurrency. But, how do these applications perform in terms of compliance?

If there is data transfer via a front-end web-based application, is that data transferred in a secure fashion?

If these projects are open to anyone to use, how are privacy policies explained to users (patients)?

Are they compliant with State and Federal laws (ie., HIPPA, HITECH)?

Below are the most significant compliance challenges facing blockchain projects in the healthcare industry today.

1. THE RIGHT TO BE FORGOTTEN

The General Data Protection Regulation (GDPR) is a relatively new compliance regulation proposed by the European Union (EU) in 2018 that is focused on giving the control of data back to its owner.

The most widely acknowledged GDPR compliance issue for blockchain remains to be the ‘right to be forgotten’.

The right to be forgotten requires that user (in this case ‘patient’) data be removed from a system at the request of the user.

This presents the most significant problem for blockchain in healthcare today as blockchain is an ‘append-only’ application and information captured on-chain is (as they say) immutable.

According to Varghese, et al (2018), this means organizations should delete the user data if the user requests it. Since information inside the blockchain cannot be removed, it directly contradicts Article 17. Technically, the same goes for Article 16 (right to rectification).

To make matters worse, this law is agnostic to public and private blockchain structures — it applies in either case.

As healthcare professionals, we tend to default to state and federal law compliance as we develop healthcare interventions in the United States.

Given the global reach of blockchain applications (worldwide network), we should understand GDPR and how it can impact that design.

2. PRIVACY AND SECURE DATA TRANSMISSION

Recent studies have found that traditional non-blockchain-based applications struggle greatly with patient privacy compliance within these rules and regulations. For example, one such study from 2021 found that out of 15,838 applications (8074 medical and 12,917 health and fitness) available on the Google Play store, 88% had code that collected some sort of user data with 23% of these applications transmitting information by way of unsecured channels and 28% providing no privacy policies to users.

Blockchain-based digital health is essentially the automation of current digital health capabilities — so let's make sure we are not automating the bad to still happen.

Current laws such as the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act are well known to those in the healthcare industry.

Let’s say we are not concerned about GDPR or unsecured data exchange…do we even have a true grasp on HIPAA and HITECH Acts as they relate to blockchain?

With regard to HIPAA, patient health information cannot be used or shared without written permission from the patient. That said, if the information is required as part of normal business operations (for example, providing care to the patient) this may not apply.

Should we then consider a blockchain solution to be HIPAA compliant by just saying all data is required as part of normal business ops? If the blockchain application is provided by a third party I do not think we can. Then we need a Business Associate Agreement (BAA) to be in place.

BAAs are a requirement of both HIPAA and the HITECH Act.

How would we then get a BAA in place with a digital health application that resides on a public blockchain? Does the creator (who can be anyone) know about these laws?

3. COMPLIANT DEVELOPMENT

We need healthcare professionals who know how to interpret patient data, implement healthcare compliance requirements, and read smart contracts.

Basically, all blockchain-based digital health applications can be categorized as creating patient-generated data.

Patient-generated data are defined as “health-related data — including health history, symptoms, biometric data, treatment history, lifestyle choices, and other information — created, recorded, gathered, or inferred by or from patients or their designees (i.e., care partners or those who assist them) to help address a health concern (Hiller, 2016).

Traditionally, data made available within the public domain by way of digital health applications are assumed to have been vetted for compliance with federal rules and regulations.

While this may be commonly accepted thinking (and still a relatively dangerous assumption to operate under given what we know about current digital health compliance studies) for more traditional applications, this thinking poses new challenges with blockchain-based applications.

This consideration should not trick us into believing an application is compliant simply because of the data source.

In order to identify weaknesses within blockchain applications against privacy and security requirements it is critical to understand how these solutions are built. This will provide valuable insight into which laws apply to data capture and how before properly understanding which data can be used widely in visualizations.

We cannot assume that data has been reviewed by a knowledgeable compliance source.

Blockchain applications are varied in where development has taken place and often developers are based outside of the United States.

Are developers familiar with US and non-US rules and regulations for patient data privacy and security?

Public blockchain applications that operate using smart contracts can easily have their code reviewed by knowledgeable US-based developers to allow for a full understanding of what data is captured and how it is stored on the blockchain (for example, is it queryable by anyone).

This will become a new healthcare industry need over time as anyone around the world can launch a smart contract on the blockchain attached to a web-based application that asks patients for data.

REFERENCES

Hiller, J.S. (2016). Healthy Predictions? Questions for Data Analytics in Healthcare. American Business Law Journal. Vol. 53 Issue 2, p251–314. 64p. DOI: 10.1111/ablj.12078

Varghese, B., Villari, M., Rana, O., James, P., Shah, T., Fazio, M. (2018). Realizing edge marketplaces: Challenges and opportunities. IEEE Cloud Comput., vol. 5, no. 6, pp. 9–20, Nov. 2018.