Health-Passport

Inspiration

Globally, over 110 million people are currently displaced. When a refugee crosses a border, they often lose more than their home, they lose their medical history. For a patient with Type 2 Diabetes or Hypertension, a lost record isn't just an administrative hurdle; it is a life-threatening gap in care. We were inspired to build a solution where health data moves as fast as people do, ensuring that a diagnosis in Syria remains actionable in Germany or a refugee camp in Kenya.

What it does

Health Passport is a portable, privacy-first digital health record built for the world's 117 million forcibly displaced people. At every border crossing or camp transfer, patients lose the one thing that keeps them alive — their medical history. A patient with a life-threatening penicillin allergy has no way to tell a French-speaking doctor in a Ukrainian field hospital what drugs to avoid.

Health Passport solves this in three layers:

1 — The patient owns a PIN-protected record that lives on any device

Registration requires only a name, date of birth, and a 4-digit PIN — no email, no phone, no ID document. Patients who hold an official UNHCR case number can link it for hard deduplication:

$$\text{UNHCR No.} \xrightarrow{\text{@unique constraint}} \text{one passport per person}$$

Records are typed and versioned with full provenance:

source confidence Meaning provider verified A doctor at a verified clinic added this self_reported unverified Patient entered from memory self_reported verified Patient entry confirmed by a clinician document_upload ai_extracted Extracted from a photo; needs review 2 — One QR code bridges the patient to any provider, in any language

The patient generates a time-limited, view-capped share token:

$$\text{entropy} = 24 \text{ bytes} \times 8 = 192 \text{ bits} \quad (\text{cryptographically secure})$$

$$\text{validity window} = 72\text{ h}, \quad \text{max views} = 10$$

Any clinician who scans it sees the full record translated in real time. Drug names (INN generics like Metformin, Lisinopril) are preserved in Latin regardless of the target language — a deliberate safety constraint to prevent prescribing errors. Six languages are supported: English, Arabic, French, Spanish, Ukrainian, Swahili — covering the primary first-language groups of UNHCR-registered refugees.

3 — Providers work inside a verified-organization portal

A tiered provider model — ORG_ADMIN and STAFF — lets clinic administrators manage staff accounts. When a patient presents their QR, the doctor's session is gated by a consent-based AccessSession. Records added by verified-org staff are immediately tagged confidence = "verified". The portal also surfaces aggregated public health signals using a k-anonymity threshold:

$$\text{signal published} \iff \text{case count} \geq k, \quad k = 5$$

This prevents any individual patient record from being inferred from analytics data.

How we built it

We developed Health Passport as a secure, portable, and organization-centric medical ecosystem.

The Stack: Built with Next.js 14 (App Router) for a high-performance frontend and Prisma with SQLite for a robust, relational data layer. Relational Trust Model: Instead of a central authority, we implemented a decentralized trust hierarchy where: NGO→verifiesStaff→signsMedical Record\text{NGO} \xrightarrow{\text{verifies}} \text{Staff} \xrightarrow{\text{signs}} \text{Medical Record}NGOverifies​Staffsigns​Medical Record This ensures that every entry has a traceable "Source of Truth" from verified organizations like MSF or local clinics. AI-Powered Continuity: We integrated Llama-3 to solve the problem of non-standardized medication. The app detects the user's timezone to infer their region and maps prescriptions to local equivalents: f(original_drug,current_region)→local_brand_namef(\text{original_drug}, \text{current_region}) \rightarrow \text{local_brand_name}f(original_drug,current_region)→local_brand_name

Challenges we ran into

The Privacy-Usability Paradox: I had to balance strict patient consent (PIN-protected QR codes) with the reality of emergency care. I solved this by allowing Bypass Verification, where trusted providers can access records instantly during a consultation while maintaining a full access log. Data Standardization: Medications and symptoms are described differently across languages and regions. Using LLMs allowed us to bridge these semantic gaps where traditional databases failed. Anonymization: Building the public health dashboard required ensuring that camp-level trends didn't inadvertently de-identify individuals.

Accomplishments that we're proud of

Provenance without a blockchain. Every record carries source and confidence without any distributed ledger. The trust chain is purely relational: a verified organization → a verified provider → a signed record. Simple, auditable, zero overhead.

Translation that doesn't break medicine. The naïve approach — "translate everything" — is dangerous. We specifically instruct the language model to leave WHO INN drug names in their original Latin form and translate only surrounding descriptive prose. A French doctor should read "Allergie sévère à la Pénicilline" — not a back-translated approximation of a drug name that might not match their formulary.

PIN-only auth that is actually secure. We hash PINs with bcrypt at cost factor 10:

$$H = \text{bcrypt}(\text{PIN}, c=10) \quad \Rightarrow \quad 2^{10} \approx 1{,}024 \text{ rounds per attempt}$$

Even though the PIN space is only $10^4 = 10{,}000$ combinations, the cost factor makes online brute-force impractical within a session and offline attacks expensive. The JWT secret is independent and production-rotatable.

AI extraction that knows its limits. Document upload runs a vision model against the image and returns structured JSON. If the image is not a medical document it returns {"error": "Not a medical document"} and we surface that to the user rather than hallucinating a record. Every AI-extracted record is tagged confidence = "ai_extracted" so a clinician knows it needs human review before acting on it.

Privacy-safe analytics. We ship an analytics dashboard for NGO coordinators — outbreak signals, medication demand, vaccination coverage — with a hard floor of $k \geq 5$ cases before any aggregate is surfaced. No individual record, diagnosis, or patient can be inferred from the published numbers.

Zero dependencies on identity infrastructure. The app requires nothing from the host country's ID systems, no SIM card, no email server, no internet for the patient-facing views once installed as a PWA. A refugee in a camp with intermittent connectivity can still show their emergency card offline.

What we learned

The biggest takeaway was that Trust is Relational. In humanitarian contexts, refugees trust the organizations on the ground. By building a system where trust is inherited from these organizations, we created a platform that mirrors real-world humanitarian workflows. We also learned that AI’s greatest value in healthcare isn't just diagnosis, but translation and continuity, mapping data from one system's "language" to another.

What's next for Health-Passport

Offline-first sync with conflict resolution

The PWA currently caches the UI shell. The next step is a local SQLite replica on the device (via OPFS) that syncs to the server when connectivity is available. Record merges use a last-write-wins strategy with a vector clock per patient to detect and surface conflicts:

$$\vec{v}_\text{merge} = \max(\vec{v}_A,, \vec{v}_B) \quad \text{componentwise}$$

Biometric unlock as a PIN alternative

The WebAuthn API (available in all modern browsers) allows a platform authenticator (Face ID, fingerprint) to replace the PIN entirely without storing any biometric data on the server. The private key never leaves the device.

End-to-end encryption of record content

Currently records are stored in plaintext in the database (protected by server-side access control). The next milestone is client-side encryption: the patient's PIN is used to derive an AES-256-GCM key with PBKDF2, and all title + description fields are encrypted before they leave the browser:

$$k = \text{PBKDF2}(\text{PIN},, \text{salt},, i=310{,}000,, \text{SHA-256}) \in {0,1}^{256}$$

The server stores only ciphertext; translation happens by decrypting client-side, calling the LLM, and re-encrypting. Providers receive a one-time decryption grant scoped to the share token lifetime.

UNHCR / IRC data integration

With organizational approval, Health Passport can ingest existing UNHCR ProGres registration data and IRC EMR records, pre-populating a patient's passport on first login. This eliminates the cold-start problem for newly registered refugees.

Wearable QR wristband

For unconscious or non-verbal patients, a printed QR wristband generated at registration gives any first responder instant access to the emergency card — blood type, critical allergies, current medications — with no PIN required for that read-only view.

Population health layer

The current analytics are facility-scoped. A future aggregation layer — using differential privacy with calibrated Laplace noise — would allow cross-facility, cross-country disease surveillance while providing a formal privacy guarantee:

$$\mathcal{M}(x) = f(x) + \text{Lap}!\left(\frac{\Delta f}{\varepsilon}\right), \quad \varepsilon \ll 1$$

This would give WHO and UNHCR epidemiologists real-time insight into outbreak patterns across displacement corridors without ever exposing individual records.

Built With

• bcryptjs
• css
• groq
• next.js
• prisma
• react
• shadcn/ui
• sql
• tailwind
• typescript