Blockchain-based mechanisms for secure health information resource exchange
Technologies are disclosed herein to secure flexible access to the healthcare information resources (HIR) contained within electronic health records (EHR) systems. By managing access permissions with certified self-sovereign identities and distributed ledger techniques, HIR may be secured. Patients and other users may be registered to access a distributed ledger, such as a healthcare blockchain, employed to set, host and adjudicate permissions to access HIR. Authorized owners and/or patients with rights to their own HIR may be able to grant fine-grained and conditional access permissions to third-parties. Information transfers and transactions occurring according to these permissions may be logged within smart contracts incorporated in the healthcare blockchain.
1. A computer-implemented method, comprising:
receiving, by a client systems module of a value-added certificate authorization system comprising one or more processors, from a client system, a request to certify a self-sovereign identity certificate (SIC) for access to a healthcare blockchain;
requesting, by the client systems module of the value-added certificate authorization system, and from the client system, personal identification information associated with the SIC;
receiving, by the client systems module of the value-added certificate authorization system, the personal identification information;
requesting, by an identity authority module of the value-added certificate authorization system, from an independent identity authority system, verification of the personal identification information;
receiving, from the independent identity authority system and by the identity authority module of the value-added certificate authorization system and further responsive to requesting the verification of the personal identification information, data indicative of the authenticity of the personal identification information;
verifying, by the identity authority module of the value-added certificate authorization system and by using the data indicative of authenticity of the personal identification information, the personal identification information;
certifying, by the identity authority module of the value-added certificate authorization system, responsive to the verification, the SIC;
generating, by a certified sovereign identity (CSI) key module of the value-added certificate authorization system and based at least in part on certifying the SIC, a CSI; and
instructing, by a blockchain module of the value-added certificate authorization system, a blockchain system to include a public key associated with the CSI on the healthcare blockchain.
2. The computer-implemented method of claim 1 , further comprising:
receiving, by a patient identification module of the value-added certificate authorization system, a request to grant a permission to access a health information resource to a user associated with the CSI;
determining, by the patient identification module of the value-added certificate authorization system and based at least in part on the CSI, that the user is authorized to gain permission to access the health information resource; and
instructing, by the blockchain module the value-added certificate authorization system, a blockchain system to include a smart contract corresponding to the grant of the permission to the user to access the health information resource.
3. The computer-implemented method of claim 1 , further comprising:
receiving, by an application download module of the value-added certificate authorization system, from an application download system, a request to bind the CSI to a healthcare application; and
instructing, by the application download module of the value-added certificate authorization system and responsive to the request to bind the CSI to the healthcare application, storing the CSI in a digital wallet of the client system.
4. The computer-implemented method of claim 1 , wherein the CSI is a first CSI, the first CSI corresponding to a first user, the method further comprising:
receiving, by a patient identification module of the value-added certificate authorization system, a request to grant a permission to access a health information resource to a second user, the second user having a second CSI;
determining, by the patient identification module of the value-added certificate authorization system and based at least in part on the first CSI, that the first user is authorized to set permissions to access the health information resource; and
instructing, by the blockchain module the value-added certificate authorization system, a blockchain system, to include a smart contract corresponding to the grant of the permission to the second user to access the health information resource.
5. The computer-implemented method of claim 4 , wherein the grant of the permission to access the health information resource comprises one or more conditions under which the second user is permitted to access the health record.
6. The computer-implemented method of claim 4 , wherein the client system is a first client system, and wherein the smart contract comprises instructions to issue an access token to the second user, the access token allowing a second client system corresponding to the second user to receive the health information resource from a resource server.
7. A system, comprising:
a non-transitory computer readable media that stores computer-executable instructions;
at least one processor configured to access the memory, wherein the at least one processor is further configured to execute the computer-executable instructions to:
receive, by a client systems module and from a client system, a request to certify a self-sovereign identity certificate (SIC) for access to a healthcare blockchain;
request, by the client systems module from the client system, a plurality of personal identification information associated with the sovereign identity;
receive, by the client systems module, the plurality of personal identification information;
request, by an identity authority module and from an independent identity authority system, verification of the plurality of personal identification information;
receive, from the independent identity authority system and responsive to requesting the verification of the plurality of personal identification information, data indicative of the authenticity of the plurality of personal identification information;
verify, by the identity authority module and based at least in part on the data indicative of the authenticity of the plurality of personal identification information, the plurality of personal identification information;
certify, by the identity authority module and responsive to the verification, the SIC;
generate, by a certified sovereign identity (CSI) key module and based at least in part on certifying the SIC, a certified sovereign identity (CSI); and
instruct, by a blockchain module and by the value-added certificate authorization system, a blockchain system to include a public key associated with the CSI on the healthcare blockchain.
8. The system of claim 7 , wherein the CSI comprises a public key that is included in the healthcare blockchain and a private key that is stored on the client system.
9. The system of claim 7 , wherein the at least one processor is further configured to execute the computer-executable instructions to:
receive, by an application download module and from an application download system, a request to bind the CSI to a healthcare application; and
instruct, by the application download module and responsive to the request to bind the CSI to the healthcare application, storing the CSI in a digital wallet of the client system.
10. The system of claim 7 , wherein the CSI is a first CSI, the first CSI corresponding to a first user, and wherein the at least one processor is further configured to execute the computer-executable instructions to:
receive, by a patient identification module, a request to grant a permission to access a health information resource to a second user, the second user having a second CSI;
determine, by the patient identification module and based at least in part on the first CSI, that the first user is authorized to set permissions for the health information resource; and
instruct, a blockchain system, to include a smart contract corresponding to the grant of the permission to the second user to access the health information resource.
11. The system of claim 10 , wherein the grant of the permission to access the health information resource comprises one or more conditions under which the second user is permitted to access the health information resource.
12. The system of claim 10 , wherein the client system is a first client system, and wherein the smart contract comprises instructions to issue an access token to the second user, the access token allowing a second client system corresponding to the second user to receive the health information resource from a resource server.
13. One or more non-transitory computer-readable media maintaining instructions executable by one or more processors to perform operations comprising:
receiving, by a client systems module of a value-added certificate authorization system comprising one or more processors, from a client system, a request to certify a self-sovereign identity certificate (SIC) for access to a healthcare blockchain;
requesting, by the client systems module of the value-added certificate authorization system, and from the client system, personal identification information associated with the SIC;
receiving, by the client systems module of the value-added certificate authorization system, the personal identification information;
requesting, by an identity authority module of the value-added certificate authorization system, from an independent identity authority system, verification of the personal identification information;
receiving, from the independent identity authority system and by the identity authority module of the value-added certificate authorization system and further responsive to requesting the verification of the personal identification information, an indication of the authenticity of the personal identification information;
verifying, by the identity authority module of the value-added certificate authorization system and by using the data indicative of authenticity of the personal identification information, the personal identification information;
certifying, by the identity authority module of the value-added certificate authorization system, responsive to the verification, the SIC;
generating, by a certified sovereign identity (CSI) key module of the value-added certificate authorization system and based at least in part on certifying the SIC, a CSI; and
instructing, by a blockchain module of the value-added certificate authorization system, a blockchain system to include a public key associated with the CSI on the healthcare blockchain.
14. The one or more non-transitory computer-readable media of claim 13 , wherein the operations further comprise:
receiving, by a patient identification module of the value-added certificate authorization system, a request to grant a permission to access a health information resource to a user associated with the CSI;
determining, by the patient identification module of the value-added certificate authorization system and based at least in part on the CSI, that the user is authorized to gain permission to access the health information resource; and
instructing, by the blockchain module of the value-added certificate authorization system, a blockchain system, to include a smart contract corresponding to the grant of the permission to the user to access the health information resource.
15. The one or more non-transitory computer-readable media of claim 13 , wherein the operations further comprise:
receiving, by an application download module of the value-added certificate authorization system, from an application download system, a request to bind the CSI to a healthcare application; and
instructing, by an application download module of the value-added certificate authorization system and responsive to the request to bind the CSI to the healthcare application, storing the CSI in a digital wallet of the client system.
16. The one or more non-transitory computer-readable media of claim 13 , wherein the CSI is a first CSI, the first CSI corresponding to a first user, and wherein the operations further comprise:
receiving, by a patient identification module of the value-added certificate authorization system, a request to grant a permission to access a health information resource to a second user, the second user having a second CSI;
determining, by a patient identification module of the value-added certificate authorization system and based at least in part on the first CSI, that the first user is authorized to set permissions to access the health information resource; and
instructing, by the blockchain module of the value-added certificate authorization system, the blockchain system, to include a smart contract corresponding to the grant of the permission to the second user to access the health information resource.
17. The one or more non-transitory computer-readable media of claim 16 , wherein the grant of the permission to access the health information resource comprises one or more conditions under which the second user is permitted to access a health record.
18. The computer-implemented method of claim 1 , further comprising:
providing, by the client systems module of the value-added certificate authorization system, a private key associated with the CSI to the client device.
19. The system of claim 7 , wherein the at least one processor is further configured to execute the computer-executable instructions to:
instructing, by the blockchain module of the value-added certificate authorization system, a blockchain system, to include a smart contract corresponding to the grant of the permission to a user associated with the client system to access a health information resource associated with the user.
20. The one or more non-transitory computer-readable media of claim 13 , wherein the operations further comprise:
providing, by the client systems module of the value-added certificate authorization system, a private key associated with the CSI to the client device.