Sharing healthcare data securely

Sector: Quaternary sector · Industry: Health technology · Organisation: Booz Allen Hamilton, U.S. Food and Drug Administration · Maturity level: Pilot

Booz Allen Hamilton developed a blockchain pilot platform for the U.S. Food and Drug Administration (FDA) to securely provide clinical health data from different source systems. As part of the project, technical data extraction and connectivity with four academic medical centres were successfully trialled. A permissioned Ethereum network controlled access rights, while sensitive original data was managed encrypted off the blockchain via IPFS and microservices.

Documentation status

• Project status: Pilot (as of 01 January 2021) — Pilot conducted with four academic medical centres; no evidence of sustained, widespread production operation.
• Evidence: Evidence high
• Editorial review: SapientBlock Redaktion, 24 October 2026

Description

Booz Allen Hamilton, together with the U.S. Food and Drug Administration, designed a technical platform to secure the exchange of sensitive health data between clinics and authorities. In many healthcare institutions, patient data sits in isolated data silos, which hampers regulatory oversight and scientific evaluation. The system uses blockchain technology as a neutral notary for permissions, while the original medical data remains encrypted at the participating hospitals.

The pilot demonstrated technical data extraction and controlled provision of health data to four academic medical centres in the United States. To meet strict data protection requirements, the consortium decided against storing medical data directly on the blockchain. Instead, a permissioned Ethereum network manages cryptographic hash values and detailed access rights. The actual data holdings are stored encrypted off-chain via the InterPlanetary File System (IPFS). Containerised, Docker-based microservices provide the connection to the respective electronic patient record systems of the clinics, although widespread production deployment has not yet been evidenced.

Perspectives

B2B — organisations perspective

Healthcare organisations and authorities can define and audit structured access rules without having to copy sensitive raw data in an uncontrolled manner. This facilitates cooperation between regulatory bodies and academic research centres.

Employees perspective

IT administrators and data managers in clinics gain transparent tools for controlling data requests from external parties. Manual preparation and bilateral export of datasets are reduced through standardised interfaces.

Benefits

General

• Audit-proof logging of all data queries
• Avoidance of central monopolies in the storage of sensitive health data
• Compliance with regulatory data protection requirements through an off-chain architecture

B2B — organisations

• More efficient data connectivity between authorities and medical centres
• Standardised permission checks via smart contracts

Employees

• Reduced manual review effort for regulatory data transmissions

Challenges

General

• High integration effort due to heterogeneous clinical primary systems
• Lack of robust long-term studies on the cost-effectiveness of the approach
• Legal and organisational coordination between independent institutions

B2B — organisations

• Lack of binding industry standards for blockchain-based healthcare networks

Employees

• Training requirements for IT staff regarding containerised off-chain storage models

Technology foundation

The solution is based on a permissioned Ethereum network with Proof-of-Authority consensus for tamper-proof management of access rights and audit trails. To comply with data protection requirements, patient data is not stored directly on the blockchain but is instead stored encrypted off-chain via the InterPlanetary File System (IPFS) and connected via containerised microservices.

Implementation examples

FDA Blockchain Health Data Sharing Pilot

Clinical data from different hospital systems was to be made usable for the FDA's regulatory and monitoring tasks, without relinquishing control over the original data to a central authority.

Booz Allen Hamilton trialled a decentralised platform for the FDA to enable controlled data exchange with four academic medical centres.

As part of this project, a permissioned Ethereum network was built to cryptographically secure data releases and audit trails. Four academic medical centres were connected via containerised microservices to automatically extract clinical data. To comply with medical data protection standards, confidential primary data remained encrypted off the chain, using IPFS.

Inconsistent IT infrastructures across hospitals and strict regulatory hurdles concerning data protection for medical datasets.

Tags

Healthcare data, Access management, Interoperability, Proof of Authority, Data protection

Sources

1. Blockchain Distributed Ledger Technologies for Biomedical and Health Care Applications
2. Implementation of a Blockchain-Based Secure Data Broker
3. Keeping Public Health Ahead of Epidemics With Blockchain
4. FDA Builds Blockchain-Based Health Data Sharing Platform

Related use cases

• Sharing patient data securely — MIT Media Lab, Beth Israel Deaconess Medical Center
• eBtM - Electronic Narcotic Prescription with Blockchain — Charité Berlin & Universität Ulm (unterstützt vom BMG)
• IBM Blockchain Transparent Supply for Supply Chain Transparency — IBM in Kooperation mit Walmart, SAP
• MediLedger Product Verification System — Chronicled, Inc. (seit 2023 unter NABP)
• Managing employee access in a data-secure manner — DB Systel