Skip to content
All projects

Health

HealthVault

HealthVault lets a patient lock their health records in the browser, share them with a chosen doctor for a set time, and see every visit in a log nobody can change. The blockchain only holds permissions and fingerprints, never the records themselves.

Source code

A doctor only receives a record's key after their visit has been written to the blockchain.

A doctor opens shared records, and each visit is written to the blockchain
Records are encrypted in the browser before they are saved
The patient shares access with a doctor for a set time
An activity log nobody can edit, read straight from the chain
Three ways to snoop, and why each one fails
Smart contract tests for permissions, expiry and revocation

01 / 07A doctor opens shared records, and each visit is written to the blockchain

Overview

Health records usually sit on servers that patients cannot see into, and it is hard to know who has looked at them. HealthVault is a learning prototype that puts the patient in charge: they decide which doctor can open their records, for how long, and they can see every visit.

Records are encrypted in the browser before they leave it and are stored off-chain. A smart contract keeps only the permission slips, a fingerprint of each file and a visitor log. When a doctor opens a record, the visit is written to the chain first, and only then does the storage server hand over the locked key.

It runs entirely on your computer with a local test chain and made-up people: a patient, two doctors and a stranger who tries, and fails, to snoop.

Features

  • Create a vault and add records that are encrypted before they are saved
  • Share records with a doctor for an hour, a day, a week or a month, and stop at any time
  • Open shared records as a doctor, with the fingerprint checked against the chain
  • Read a permanent activity log of shares, revocations and visits
  • Try three snooping attempts as a stranger and see what blocks each one
  • Tamper with a stored file behind the scenes and watch the app flag it

Challenges

  • Keeping health data off a public ledger while still using it for trust: only fingerprints and permissions go on-chain
  • Envelope encryption with X25519, HKDF and AES-GCM in Web Crypto, so each record key can be locked separately for each doctor
  • Making the storage server release keys only after checking that a visit was logged on-chain, so a stolen server still reveals nothing readable
  • Testing permission expiry and revocation in Solidity, plus an end-to-end script that runs the whole flow against a real local chain