BlockHealth_Vault

Inspiration

Healthcare records today are scattered across hospitals, clinics, and labs — each running its own siloed, centralized database. These systems are frequent targets of data breaches, and patients have little real control over who can see their own medical history. We wanted to flip that model: instead of providers owning patient data, patients should own and control it, granting access only when and to whom they choose. Blockchain's immutability and smart-contract-based permissioning felt like the perfect fit for building that kind of trust layer into healthcare.

What it does

Block Health Vault is a Digital Patient Health Record (EHR) system that combines off-chain encrypted storage with on-chain access control:

Patients upload medical records (lab results, prescriptions, imaging reports, etc.), which are encrypted and stored off-chain on IPFS, while only the record's hash is committed to the blockchain — guaranteeing immutability without bloating the chain.
Patients can grant temporary, time-bound access to specific doctors or providers through a smart contract, specifying an expiry time for that permission.
Providers see only the records they've been explicitly granted access to, and that access automatically expires.
Every access event — grant, revoke, view — is logged on-chain, giving patients a transparent, tamper-proof audit trail of who viewed their data and when.
A clean web dashboard lets patients upload records, manage active/expired access grants, and review their audit log, while doctors get their own view limited to records shared with them.

How we built it

Frontend: Built a multi-page web dashboard (landing page, patient dashboard, upload-record flow, grant-access flow, audit log, and a separate doctor view) using HTML/CSS/JavaScript (React).
Backend: An Express (Node.js) / FastAPI (Python) service handles requests between the frontend, IPFS, and the blockchain layer.
Blockchain layer: Smart contracts written in Solidity, developed and tested with Hardhat/Truffle, deployed to an Ethereum testnet, and connected to the frontend via MetaMask for wallet-based authentication and transaction signing.
Storage: Encrypted medical files are stored on IPFS; only content hashes and access-control metadata live on-chain, keeping gas costs low while preserving immutability.
Database: MongoDB/PostgreSQL handles off-chain metadata (user profiles, record indexing) that doesn't need to live on the blockchain.
We started by mapping the architecture (patient ↔ application backend ↔ smart contracts/IPFS ↔ providers), then built the smart contracts for access grant/revoke logic first, before wiring up the frontend flows around them.

Challenges we ran into

Designing time-bound access in Solidity: Most blockchain access-control examples are permanent (grant/revoke), not temporary. We had to design smart contract logic that tracks expiry timestamps and automatically treats expired grants as invalid without needing a centralized "ticking clock."
Balancing on-chain vs. off-chain data: Deciding exactly what belongs on-chain (hashes, permissions, audit events) vs. off-chain (the actual encrypted files, user metadata) to keep transactions cheap while still preserving the immutability guarantees that make blockchain worth using here.
Encryption workflow: Making sure medical files are encrypted before they ever leave the patient's session, so that even IPFS — a public, content-addressed store — never holds readable health data.
Interoperability: Designing the access-control and audit-log structures generically enough that providers using different downstream systems could eventually integrate with our verification flow.

What we learned

How to design smart contracts for patient-centric, time-bound permissioning rather than the simpler all-or-nothing access models most tutorials cover.
The practical tradeoffs of hybrid on-chain/off-chain architectures (cost, speed, immutability) when handling sensitive, large data like medical records.
How to integrate MetaMask-based wallet authentication into a real product flow with two different user roles (patient and provider).

What's next for Block Health Vault

Mainnet/Layer-2 deployment to reduce gas costs for everyday use.
Role-based provider verification (so only licensed providers can be granted access).
Mobile app support and push notifications for access requests.
Integration with real-world hospital systems via HL7/FHIR standards.