SIGHTED (Secure Medical Records Sharing)

SIGHTED (Secure Information Guarding Healthcare Through Encrypted Data) enables the secure and private sharing of medical records between patients and healthcare providers.

Comment

S.I.G.H.T.E.D. (Secure Information Guarding Healthcare Through Encrypted Data)

Inspiration

SIGHTED was inspired by the urgent need to protect sensitive healthcare data in the face of escalating privacy concerns.

A 2023 report by the Ponemon Institute reveals that the average cost of a data breach in the healthcare sector has reached $10.1 million, making it the highest among all industries. [Ponemon Institute Report on Data Breach Costs: www.ibm.com/reports/data-breach]

High-profile incidents, such as the Facebook data breach in 2019—which exposed the personal information of 540 million users—have amplified public awareness of data privacy issues, highlighting the pressing need for solutions that safeguard personal information in healthcare. [Facebook Data Breach: www.npr.org/2021/04/07/984111315/facebook-data-breach-exposed-540-million-users-information]

Furthermore, the U.S. Department of Health & Human Services reported 470 breaches affecting over 27 million individuals in 2022 alone, underscoring the critical requirement for enhanced data privacy measures within the healthcare sector. [U.S. Department of Health & Human Services Data Breach Reports: www.ocrportal.hhs.gov/ocr/breach/breach_report.jsf]

Potential Business Impact of SIGHTED

  1. Market Opportunity

The healthcare industry is increasingly prioritizing data privacy and security. With the rise in data breaches and growing public awareness, the demand for effective solutions to protect sensitive patient information is significant. According to MarketsandMarkets, the global healthcare cybersecurity market is projected to grow from $10.3 billion in 2022 to $34.6 billion by 2027, at a CAGR of 27.2%. SIGHTED is poised to capture a substantial share of this market by offering innovative privacy solutions.

  • Total Addressable Market (TAM): $34.6 billion (by 2027)
  • Serviceable Available Market (SAM): $10.38 billion (focused on data privacy solutions within healthcare cybersecurity)
  • Serviceable Obtainable Market (SOM): $519 million (expected market capture in 5 years)
  1. Revenue Streams
  • Subscription Model: SIGHTED can implement a subscription-based model for healthcare providers needing continuous access to its privacy solutions. Pricing can be tiered based on user count or data volume.
  • Transaction Fees: Introducing transaction fees for data-sharing activities on the platform can create an additional revenue stream. Each validated data transaction could incur a small fee.
  • Partnerships and Collaborations: Collaborating with technology providers, healthcare organizations, and research institutions may lead to joint ventures, enhancing revenue potential through shared innovations and services.
  • Grants and Funding: SIGHTED may qualify for government grants and funding opportunities aimed at advancing healthcare privacy technology.
  1. Cost Savings for Healthcare Providers
  • Reduced Liability Costs: By minimizing data breach risks, healthcare providers can lower potential litigation costs and penalties. The average cost of a data breach in healthcare is $10.1 million, and solutions like SIGHTED can help mitigate these financial risks.
  • Operational Efficiency: SIGHTED can streamline secure data sharing processes, reducing the time and resources spent on data management and compliance with privacy regulations.
  1. Competitive Advantage
  • Market Differentiation: SIGHTED’s innovative use of zero-knowledge proofs and a self-sovereign framework positions it uniquely within a competitive market. By addressing existing gaps in data privacy and security, it can emerge as the go-to solution for healthcare data privacy, attracting clients and investors alike.
  • Scalability: Built on the Calimero framework, SIGHTED can adapt and scale quickly according to market demands, enabling rapid expansion into new markets and sectors and potentially increasing revenue streams.
  1. Investment and Growth Potential
  • Attracting Investors: The growing focus on data privacy in healthcare makes SIGHTED a compelling investment opportunity. By demonstrating the ability to generate revenue through innovative solutions, the project can attract venture capital funding and strategic partnerships.
  • Long-Term Sustainability: As healthcare continues to evolve towards digital solutions, the demand for robust privacy measures will increase. SIGHTED is positioned to become an essential player in this landscape, ensuring long-term sustainability and growth.

In summary, SIGHTED has the potential to make a significant financial impact on the healthcare sector by addressing critical privacy concerns, creating new revenue streams, and enhancing operational efficiencies. As the emphasis on data protection intensifies, SIGHTED can leverage these market dynamics to establish itself as a leader in healthcare data privacy solutions, ultimately transforming its innovative technology into substantial business success.

What it does

SIGHTED is a cutting-edge healthcare data privacy solution built for the Calimero Privacy Track. By integrating with Calimero's framework, SIGHTED facilitates the development of self-sovereign applications that prioritize data privacy and security in healthcare. At its core, SIGHTED utilizes zero-knowledge proofs (ZKPs) to enable secure and private data sharing among healthcare stakeholders. This implementation allows healthcare providers to verify and validate patient information without exposing the actual data, effectively addressing the challenges of privacy and trust in data transactions.

Secure Medical Records Sharing : A healthcare application that enables the secure and private sharing of medical records between patients and healthcare providers, using Calimero for privacy-preserving access.

For the Privacy-Preserving Access aspect of the SIGHTED system, each role can have specific permissions for accessing and interacting with medical data, using access-control policies and privacy-preserving mechanisms.

1) Primary Care Provider (PCP)

The PCP is typically the main custodian of a patient’s medical records. With privacy-preserving access, the PCP can access the patient’s core medical history but with controls over sensitive details.

Privacy-Preserving Access Configuration:

  • Role-Based Permissions: The PCP can view and update certain sections of a patient’s record but may have limited access to highly sensitive data.
  • Encrypted Data Access: Only the PCP has decryption keys for their assigned records, ensuring patient data remains secure when accessed.
// Sample data access example for PCP
const grantPCPAccess = async (pcpId: string, patientId: string) => {
  await calimero.shard.assignRole(pcpId, {
    role: 'PRIMARY_CARE_PROVIDER',
    permissions: ['READ_PATIENT_RECORD', 'WRITE_MEDICAL_NOTES'],
  });
};

2) Radiologist

The radiologist has access to imaging data and specific test results but is restricted from viewing broader patient records unless required for treatment.

Privacy-Preserving Access Configuration:

  • Selective Access: The radiologist can only access the imaging records and associated notes, minimizing unnecessary exposure to other patient information.
  • Temporal Access Control: Access is limited to a specific period or task to prevent persistent access to patient data.
// Grant access to imaging records for radiologist
const grantRadiologistAccess = async (radiologistId: string, imagingRecordId: string) => {
  await calimero.shard.assignRole(radiologistId, {
    role: 'RADIOLOGIST',
    permissions: ['READ_IMAGING_RECORD'],
    resourceId: imagingRecordId,
  });
};

3) Insurance Company

The insurance company can access claim-related data to verify and process claims but cannot view detailed patient records.

Privacy-Preserving Access Configuration:

  • Policy-Based Access Control: Permissions are restricted to claim verification and billing details, not the patient’s complete medical history.
  • Zero-Knowledge Proofs: Data required for claims can be validated without disclosing underlying sensitive details, using cryptographic proofs.
// Grant limited access for insurance claim verification
const grantInsuranceAccess = async (insuranceId: string, claimId: string) => {
  await calimero.shard.assignRole(insuranceId, {
    role: 'INSURANCE_COMPANY',
    permissions: ['VIEW_CLAIM'],
    resourceId: claimId,
  });
};

4) Patient

The patient has full access to their medical records and can approve or revoke access to their data as needed, offering them control over their privacy.

Privacy-Preserving Access Configuration:

  • Self-Sovereign Control: Patients have the ability to provide selective access to their data and can revoke permissions at any time.
  • End-to-End Encryption: Patients’ records are encrypted, and they can use their private key to share or hide parts of their data selectively.
// Patient granting access to a specific provider
const patientGrantAccess = async (patientId: string, providerId: string) => {
  await calimero.shard.grantAccess(patientId, providerId, {
    permissions: ['READ_MEDICAL_RECORD'],
  });
};

Using Calimero's privacy-preserving capabilities with NEAR's secure smart contracts, each role can have fine-grained, controlled access to patient records, ensuring data privacy while enabling necessary medical workflows. This setup allows SIGHTED to securely manage data sharing and maintain patient autonomy over personal information.

1) Permissioned Private Shard Owned by a Single Entity

This mode allows for the most controlled environment where a single entity, such as a hospital or healthcare network, owns the shard. Access control is strict, and permissions are finely managed for each role.

  • Primary Care Provider (PCP) and Radiologist: As internal users in this single-entity shard, they receive access to patient data per the organization’s policies. Data sharing is limited to users within the entity, preventing external access.
  • Insurance Company: The insurance company can access patient claims only by secure APIs with strict, contract-based access (e.g., Zero-Knowledge Proofs) that reveal minimal information for claim verification.
  • Patient: The patient can view their records and selectively grant or revoke access to specific doctors or departments within the hospital. They retain control over their data with access logs provided by the entity.

Single-Entity Shard Permissions:

// Single-entity controlled access for internal users
const setupSingleEntityShard = async () => {
  await calimero.shard.create({
    owner: "HospitalSystem",
    mode: "PermissionedPrivateSingleEntity",
  });

  // Grant PCP access within the hospital
  await calimero.shard.assignRole("pcpId", {
    permissions: ['READ_PATIENT_RECORD', 'WRITE_MEDICAL_NOTES'],
    resourceId: "patientRecord",
  });
};

2) Permissioned Private Shard Owned by a Consortium

Here, a consortium of healthcare providers and insurance companies jointly owns the shard. This mode allows for cross-institutional data access and sharing under strict policies, where each entity can manage role-based access across multiple parties while maintaining patient data privacy.

  • Primary Care Provider (PCP) and Radiologist: PCPs and radiologists from any entity within the consortium can access patient records per their role permissions. For example, a PCP from one hospital can access imaging data from a radiologist at another consortium hospital, providing coordinated care across facilities.
  • Insurance Company: Insurance companies in the consortium have permission to access claims data only, without access to broader medical histories. Zero-Knowledge Proofs are used for privacy-preserving verification across entities.
  • Patient: Patients can authorize specific providers across the consortium to view or update their records. They benefit from seamless care coordination without losing control over who accesses their information.

Consortium Shard Permissions:

// Multi-entity controlled access for a consortium
const setupConsortiumShard = async () => {
  await calimero.shard.create({
    owner: ["HospitalSystem1", "HospitalSystem2", "InsuranceCompany1"],
    mode: "PermissionedPrivateConsortium",
  });

  // Grant cross-entity access with selective permissions
  await calimero.shard.assignRole("radiologistId", {
    permissions: ['READ_IMAGING_RECORD'],
    resourceId: "imagingRecord",
  });
};

3) Public Shard Owned by a Community

In this mode, SIGHTED operates in a more open environment where patients and providers form a decentralized community, using smart contracts for permissions. Here, transparency is high, yet patient data remains private through encryption and selective access.

  • Primary Care Provider (PCP) and Radiologist: Providers can access patient data only with explicit patient approval. Any access request is transparent, allowing patients to manage permissions independently in a community-driven environment.
  • Insurance Company: Insurance companies, as members of the public shard, can process claims, but data access is limited to required information only. Claims verification relies heavily on Zero-Knowledge Proofs for community compliance and transparency.
  • Patient: Patients are the true owners of their data, with full autonomy to grant or deny access to any provider or insurance company. This setup maximizes control, transparency, and privacy, as data cannot be accessed without explicit consent.

Community-Owned Public Shard Permissions:

// Decentralized control and transparency in a community shard
const setupCommunityShard = async () => {
  await calimero.shard.create({
    owner: "Community",
    mode: "PublicCommunity",
  });

  // Patient controls access with individual permissions
  const patientGrantAccess = async (patientId: string, providerId: string) => {
    await calimero.shard.grantAccess(patientId, providerId, {
      permissions: ['READ_MEDICAL_RECORD'],
      expiration: '2024-12-31T23:59:59Z', // Optional time-bound access
    });
  };
};

PROVIDER NODE

// providerNode.js

const express = require('express');
const bodyParser = require('body-parser');
const calimero = require('calimero'); 

const app = express();
app.use(bodyParser.json());

let patientRecords = {}; // Example patient records storage

// Middleware for authentication
async function authenticate(req, res, next) {
    const { patientId, signature } = req.body;
    // Verify the patient's signature using Calimero
    const isValid = await calimero.verifySignature(patientId, signature);
    if (!isValid) {
        return res.status(403).send('Unauthorized');
    }
    next();
}

// Endpoint to retrieve patient records
app.get('/records/:patientId', authenticate, (req, res) => {
    const { patientId } = req.params;
    const records = patientRecords[patientId];
    if (!records) {
        return res.status(404).send('Records not found');
    }
    res.json(records);
});

// Endpoint to update access permissions
app.post('/permissions', authenticate, (req, res) => {
    const { patientId, providerId, accessLevel } = req.body;
    // Update access control logic using Calimero
    calimero.updateAccess(patientId, providerId, accessLevel);
    res.send('Permissions updated');
});

// Start the server
const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
    console.log(`Provider Node running on port ${PORT}`);
});

PATIENT NODE 

// patientNode.js

const express = require('express');
const bodyParser = require('body-parser');
const calimero = require('calimero'); 

const app = express();
app.use(bodyParser.json());

let patientData = {
    // Example patient data structure
    id: 'patient123',
    records: {},
    permissions: {},
};

// Endpoint to view medical records
app.get('/myRecords', async (req, res) => {
    const { patientId, signature } = req.body;
    // Verify patient's signature
    const isValid = await calimero.verifySignature(patientId, signature);
    if (!isValid) {
        return res.status(403).send('Unauthorized');
    }
    res.json(patientData.records);
});

// Endpoint to share records with a provider
app.post('/shareRecords', async (req, res) => {
    const { providerId } = req.body;
    // Update access using Calimero
    calimero.grantAccess(patientData.id, providerId);
    res.send('Records shared with provider');
});

// Endpoint to manage permissions
app.post('/managePermissions', async (req, res) => {
    const { providerId, accessLevel } = req.body;
    // Update permissions logic
    patientData.permissions[providerId] = accessLevel;
    res.send('Permissions updated');
});

// Start the server
const PORT = process.env.PORT || 4000;
app.listen(PORT, () => {
    console.log(`Patient Node running on port ${PORT}`);
});

1. Bridging Fungible Tokens (bridging-fts)

  • Purpose: This module allows the transfer of fungible tokens between the NEAR blockchain and Calimero shards.
  • Application in SIGHTED:
    • Incentivizing Participation: You can use fungible tokens as incentives for patients and healthcare providers to participate in the secure medical records sharing system. For example, patients could earn tokens for sharing their data securely or for participating in health studies.
    • Payment for Services: Allowing healthcare providers to receive payments in tokens for services rendered can streamline billing processes and enhance trust between patients and providers.
    • Access Control: You can implement a token-based access control mechanism where patients need to hold a specific token to grant healthcare providers access to their medical records, ensuring that only authorized personnel can view sensitive information.

2. Calimero Login UI (calimero-login/ui)

  • Purpose: This component provides a user interface for users to log into the Calimero platform using their wallets.
  • Application in SIGHTED:
    • Secure Authentication: The login UI allows patients and healthcare providers to securely authenticate their identities using blockchain wallets. This reduces the risk of unauthorized access to medical records.
    • User-Friendly Experience: A well-designed login interface can enhance user experience, making it easy for users to access their medical records without complicated processes.
    • Integration with Decentralized Identity: By leveraging the Calimero login, you can implement decentralized identity solutions that give users more control over their personal data and who can access it.

3. Voting

  • Purpose: This example demonstrates how to create a poll voting mechanism on the blockchain.
  • Application in SIGHTED:
    • Consent Management: You can use a voting system to allow patients to give consent for specific uses of their medical data. For example, patients could vote on whether to share their data for research purposes or with specific healthcare providers.
    • Feedback Collection: The voting mechanism can also be used to collect feedback from patients about their experiences with the SIGHTED platform, helping to improve services based on user input.
    • Decision-Making Processes: In a collaborative healthcare environment, voting can facilitate collective decision-making among healthcare providers when it comes to patient care strategies or treatment plans.

Key Technical Implementations:

  1. Zero-Knowledge Proofs (ZKPs):
  • By employing ZKPs, SIGHTED ensures that sensitive health information can be authenticated without being revealed. For instance, a healthcare provider can verify that a patient meets certain criteria (e.g., age or medical history) without accessing the patient's entire medical record.
  • This is achieved using cryptographic algorithms that generate a proof that can be validated by a verifier, ensuring that only the necessary information is disclosed during a transaction.
    • Implementation: In SIGHTED, ZKPs can be used to validate various claims about patient data without revealing the data itself. For example, when a healthcare provider needs to confirm a patient's eligibility for a specific treatment, ZKPs enable the provider to verify this without exposing the patient's medical history.
    • Proof Generation: When a patient submits their data for verification, the SIGHTED platform generates a proof using ZKP protocols. This process involves: Data Encryption: Patient data is first encrypted using robust encryption algorithms. Commitment: The encrypted data is committed to a cryptographic hash function, creating a unique identifier without disclosing the original data.
    • Proof Construction: The ZKP protocol constructs a proof based on the encrypted data and the criteria for validation (e.g., eligibility for treatment).
    • Verification: The healthcare provider can verify the proof without accessing the underlying patient data, thus maintaining confidentiality.
  1. Calimero Framework: Private Shards:
  • SIGHTED is built on Calimero’s infrastructure, which provides tools and protocols for building self-sovereign applications. This framework supports data privacy through decentralized identity management, allowing patients to control their own data while enabling healthcare providers to access the necessary information for treatment.
  • The Calimero SDK facilitates the integration of ZKPs into healthcare applications, allowing developers to easily implement privacy-preserving features. Implementation: In SIGHTED, patient data is stored in private shards, which are encrypted segments of the blockchain that are only accessible to authorized entities. This ensures that sensitive data is not publicly visible while still being part of the broader blockchain ecosystem.
    • Data Segmentation: Patient data is segmented into shards based on specific criteria (e.g., by patient ID, treatment type, or geographic location). Each shard contains only a portion of the patient's data, reducing the risk of full data exposure.
    • Encryption and Access Control: Each shard is encrypted and associated with strict access controls. Only authorized users (e.g., specific healthcare providers) can access relevant shards, and access logs are maintained to ensure accountability.
    • Privacy Preservation: By leveraging Calimero’s architecture, SIGHTED can ensure that even if one shard is compromised, the overall confidentiality of patient data is preserved, as the data is fragmented and encrypted.
  1. Blockchain Integration:
  • The solution leverages the NEAR Protocol for its blockchain infrastructure, known for its scalability and low transaction costs. By integrating Zero-Knowledge Proofs with Calimero’s private shards, SIGHTED establishes a robust framework that not only protects sensitive patient information but also facilitates necessary data verifications in a secure and compliant manner. This ensures that SIGHTED can handle a high volume of transactions typical in the healthcare sector, all while maintaining secure and efficient operations.
  • Transactions related to data sharing are recorded on the blockchain, providing a transparent and auditable history of interactions while protecting sensitive patient information.
  1. Interoperability:
  • SIGHTED promotes interoperability between different healthcare systems and applications by utilizing standardized data formats and APIs. This allows for seamless integration with existing healthcare infrastructure and enhances collaboration across various stakeholders in the ecosystem.

Key Features:

  • Patient-Controlled Data: Patients retain full control over who accesses their data, enabling them to grant or revoke access as needed.

  • Auditable Transactions: All data-sharing actions are recorded on the blockchain, allowing for traceability without revealing sensitive information. This audit trail can be used to monitor compliance with privacy regulations.

  • Enhanced Security: Advanced cryptographic techniques ensure that data remains secure both in transit and at rest, significantly reducing the risk of data breaches.

  • Granular Access Controls: Healthcare providers can set fine-grained permissions, allowing for tailored access to patient data based on specific needs and roles.

  • Scalable Architecture: Built on the NEAR Protocol, SIGHTED is designed to scale efficiently, accommodating increasing numbers of users and data without sacrificing performance.

  • Real-Time Data Sharing: Facilitates real-time data sharing among healthcare providers, improving patient care and coordination while maintaining privacy.

  • Regulatory Compliance: SIGHTED is designed with compliance in mind, ensuring adherence to healthcare regulations like HIPAA, thereby protecting patient rights and privacy.

Through these technical implementations and key features, SIGHTED effectively addresses the pressing need for secure and private data sharing in the healthcare industry, enabling stakeholders to maintain trust while ensuring compliance with regulatory standards.

How we built it

The SIGHTED platform is built on the Calimero Network, which provides a robust framework for developing self-sovereign applications with a focus on data privacy. We implemented ZKPs using the ZoKrates toolkit, allowing us to create proofs for various healthcare data operations.

Code Example: Zero-Knowledge Proof Generation with ZoKrates

// Example code snippet for generating a proof using ZoKrates
import { initialize, compile, setup, computeWitness, generateProof } from 'zokrates-js';

// Initialize ZoKrates
const zokratesProvider = await initialize();

// Compile the program
const program = `
def main(private field x, private field y) -> (field):
    return x * y
`;
const compiledProgram = await compile(zokratesProvider, program);

// Setup
const { pk, vk } = await setup(zokratesProvider, compiledProgram);

// Compute Witness
const witness = await computeWitness(zokratesProvider, compiledProgram, [4, 3]);

// Generate Proof
const proof = await generateProof(zokratesProvider, pk, witness);

Challenges we ran into

  • Technical Complexity: Implementing ZKPs and integrating them into a blockchain framework posed significant challenges. We had to ensure that our proof generation and verification processes were efficient enough to handle real-time healthcare applications.
  • User Adoption: Convincing healthcare providers to adopt a new technology, especially in a conservative sector like healthcare, required extensive education and demonstrations of the solution’s benefits.
  • Regulatory Compliance: Navigating HIPAA (Health Insurance Portability and Accountability Act) regulations added complexity to our solution, as we needed to ensure full compliance with patient privacy laws.

Accomplishments that we're proud of

  • Prototype Development: We successfully created a functioning prototype that validates patient identity without revealing their health data, showcasing the effectiveness of ZKPs in healthcare.
  • Industry Collaboration: We engaged with healthcare professionals and received positive feedback, emphasizing the potential of SIGHTED in addressing real-world data privacy issues.
  • Proof of Concept with Facebook Data: By leveraging historical data breaches like the Facebook incident, we created a use case demonstrating how SIGHTED can prevent unauthorized access to sensitive health information.

What we learned

  • User-Centric Development: Early involvement of healthcare professionals was crucial for identifying pain points and ensuring our solution met user needs effectively.
  • Importance of Regulatory Understanding: Thorough knowledge of healthcare regulations is essential for the successful deployment of data privacy solutions.
  • Market Demand for Privacy Solutions: The increasing public concern about data privacy, highlighted by incidents like Facebook’s breach, creates a significant market opportunity for solutions like SIGHTED.

What's next for SIGHTED

  • Demographic Bias: We aim to implement features that mitigate demographic bias in healthcare data by ensuring equitable access and representation in our data-sharing models. This will involve working closely with diverse communities to gather input and tailor our solution to their unique needs.
  • Healthcare in Remote Areas: SIGHTED will focus on enabling secure data sharing for healthcare providers in remote areas. By providing a reliable framework for privacy-preserving data exchange, we can help improve access to healthcare services for underserved populations.
  • Hindered Research on Rare Diseases: The SIGHTED platform will seek to facilitate research into rare diseases by allowing researchers to securely access and share anonymized patient data. By leveraging ZKPs, we can enable valuable insights while ensuring that sensitive health information remains protected.
  • Further Development and Testing: We plan to enhance our prototype based on real-world feedback and conduct comprehensive security testing to validate our approach.
  • Partnership Development: Establishing partnerships with healthcare providers and technology companies will facilitate broader adoption and integration of SIGHTED.
  • Regulatory Compliance Strategy: We will develop a roadmap to ensure continuous compliance with healthcare regulations, preparing us for any future changes in legislation.
  • Market Launch: Our objective is to launch SIGHTED within the next year, targeting healthcare organizations looking for robust privacy solutions.

Built With

Share this project:

Updates

Submission history