Sharing patient data securely

Sector: Quaternary sector · Industry: Health technology · Organisation: MIT Media Lab, Beth Israel Deaconess Medical Center · Maturity level: Pilot

The MIT Media Lab developed the MedRec prototype together with Beth Israel Deaconess Medical Center and trialled it in a pilot project. Smart contracts on a private Ethereum blockchain managed access rights and authorisation logs; the actual health data remained off the blockchain in local systems. A prototype and pilot are documented, not widespread clinical production use.

Documentation status

• Project status: Pilot — Research prototype and pilot with Beth Israel Deaconess Medical Center; no widespread production operation documented.
• Evidence: Evidence high
• Editorial review: SapientBlock Redaktion, 24 October 2026

Description

The MIT Media Lab developed the MedRec system together with Beth Israel Deaconess Medical Center to demonstrate the secure exchange of medical records between different healthcare institutions. Rather than storing sensitive findings directly on a blockchain, the network functions as a decentralised register of access rights and pointers to existing clinical databases. This allows each hospital to retain sovereignty over its internal records, while patients and clinicians can trace data flows transparently and immutably.

In the MedRec project, researchers from the MIT Media Lab and clinicians from Beth Israel Deaconess Medical Center explored a novel access management approach for fragmented health data. The technical architecture is based on a private Ethereum blockchain, on which smart contracts map out authorisation logic and cryptographic references to local electronic patient records. Sensitive medical details remain strictly off-chain within the established systems of the treating organisations, ensuring data protection requirements are upheld. During the pilot, interoperability between different hospital information systems was successfully demonstrated in test operation. The project delivered valuable insights into permission structures in healthcare, but was not carried forward into widespread commercial production operation after the pilot phase concluded.

Perspectives

B2B — organisations perspective

Clinics and medical service providers can exchange treatment data with external partners without having to build a central intermediary platform. Smart contracts allow cooperation agreements and access permissions to be recorded in a technically binding and verifiable way.

B2C — consumers perspective

Patients gain a transparent overview of which institutions are permitted to view their treatment data. The decentralised allocation of permissions strengthens trust in the digital exchange of sensitive health information.

Employees perspective

Clinical staff benefit from seamless insight into authorised prior findings, which reduces duplicate examinations and speeds up diagnosis. Managing access permissions requires clear protocols so that treatment workflows are not slowed down by complex authorisation steps.

Benefits

General

• Immutable logging of access rights and consents via smart contracts
• Protection of sensitive treatment data through consistent off-chain storage in clinical systems
• Reduction of friction in cross-institutional information exchange

B2B — organisations

• Interoperability between separate and historically grown clinical IT infrastructures
• Legally sound and auditable documentation of data transfers between organisations

B2C — consumers

• Improved control over the sharing of one's own electronic health record
• High transparency regarding data queries made by medical institutions

Employees

• Faster access to authorised external findings for treating physicians
• Clearly regulated release processes in everyday clinical documentation

Challenges

General

• Complex technical integration into heterogeneous and outdated hospital IT systems
• Lack of regulatory standardisation for blockchain-based access systems in healthcare

B2B — organisations

• High need for coordination and harmonisation between participating healthcare organisations
• Lack of financial incentives for clinics to provide open interfaces on an ongoing basis

B2C — consumers

• Obstacles for laypeople in independently managing complex rights profiles digitally

Employees

• Additional training required to handle digital keys and authorisation mechanisms

Technology foundation

Private Ethereum blockchain with smart contracts for decentralised access control and a pointer structure referencing existing electronic patient records outside the blockchain (off-chain data storage).

Implementation examples

MedRec pilot project for decentralised medical access management

Electronic health records are often distributed across different practices and clinics, which hampers the flow of information and deprives patients of control over their own treatment data.

The MIT Media Lab developed the MedRec system together with Beth Israel Deaconess Medical Center for the decentralised release of patient data. The pilot trial used a private Ethereum instance to coordinate references to records and permissions without storing patient data on the blockchain.

The MIT Media Lab designed and implemented a prototype called MedRec together with Beth Israel Deaconess Medical Center, which was tested in a pilot environment. The aim was to overcome the fragmentation of electronic patient records without building a risky central data archive. Smart contracts on a private Ethereum blockchain managed access policies and cryptographic pointers to the respective data stores of participating clinics. The project demonstrated the technical feasibility of federated access control, but was concluded as a research pilot and not rolled out into clinical production operation.

Avoiding central security risks for health data by retaining local data storage and meeting strict data protection requirements through a purely off-chain architecture.

Tags

Patient data, Smart contracts, Access management, Interoperability, Off-chain storage

Sources

1. MedRec: A Case Study for Blockchain in Healthcare
2. Who Will Build the Health-Care Blockchain?
3. MedRec: Blockchain for Medical Data Access
4. Blockchain Reaction: Healthcare

Related use cases

• Sharing healthcare data securely — Booz Allen Hamilton, U.S. Food and Drug Administration
• eBtM - Electronic Narcotic Prescription with Blockchain — Charité Berlin & Universität Ulm (unterstützt vom BMG)
• IBM Blockchain Transparent Supply for Supply Chain Transparency — IBM in Kooperation mit Walmart, SAP
• MediLedger Product Verification System — Chronicled, Inc. (seit 2023 unter NABP)
• Managing employee access in a data-secure manner — DB Systel