Using blockchain to create national personal vaccination records

Paul SulkersPrior to your eyes glazing over, this paper is not about bitcoin or crypto currencies, nor is it a technical outline of blockchain, but it is about the fundamental blockchain technologies that underly these currencies, and is now sweeping massive change across many sectors of our economy. As the pandemic, immunization registries and this blockchain phenomena converge, we are presented with an opportunity to apply blockchain technology to secure our healthcare data, specifically a national immunization registry with access controlled or mediated by consumers—consumer mediated health data exchange.As background, we would all agree that secure, digital access by consumers underpins our daily lives across many sectors of our economy. Nowhere could this be more important than in healthcare; however, nowhere has it been more difficult to accomplish than in the healthcare industry! The topic of consumer access and control over their personal health information (PHI)—their ability to mediate who can or can not see their PHI—has been shrouded in 20 years of industry ambivalence.The global pandemic and the urgency of re-starting the free flow of people and goods is about to change this status quo. As vaccination programs roll-out, we must understand the emerging imperative of a personal vaccination record (PVR) for every Canadian. No longer just the yellow or blue book of your child’s vaccination records, emerging requirements will demand an individual reliance on their PVR in order to access public gatherings, utilize international air transport or gain employment. In a sense, a digital passport of their immunization history.Although the PVR is not the complete scope of a person’s health record, the PVR will test all aspects of consumer access, accuracy of record keeping systems, sharing among consumer designated recipients, and consumer trust that all involved are correctly identified and authorized. In this pandemic world, our national PVR must be based on a "chain of trust" enabling the frictionless flow of data, including authorizations, permissions and refusals, and all underpinned by trust in authority and data quality. And lastly, this chain of trust must be immutable.However, our current healthcare chain of trust is anything but "frictionless" and is either clearly broken or very tangled! Our current healthcare processes lack trust among participants, and are significantly impacted by "friction,” causing inefficiency and potential for inadvertent disclosures. Traditionally, the commercial sector has tried to overcome friction by establishing intermediaries or central data stores (banks, governments and retail accounts), that imply a level of trust regarding accuracy of data and security. We have used similar models in the health sector via intermediaries such as the Canadian Institute for Health Information (CIHI) and Ontario’s lab system (OLIS), etc.Historically, intermediaries can be encumbered by inefficient validation or correction processes, present the risk of inadvertent disclosure, and open potential for deliberate disclosure, abuse and fraud. In addition, increasingly over the past decade, centralized repositories are vulnerable to cybercrime, witnessed by ransomware attacks on several Ontario businesses in October, and more recently on U.S. government departments.Canada may move forward to establish a secure national PVR using an intermediary approach such as the Public Health Agency of Canada, CIHI or a similar agency. This may of course be expedient given the urgency to roll out vaccination programs and given that we have not yet seen similar incursions on our healthcare intermediaries. However, although hacking of credit card information has proven to be inconvenient for many, we need to understand the future implications of a hacked or compromised national PVR, where our records are damaged or altered, or held under ransom. Fast forward to emerging requirements to use your secure PVR for global travel, employment or event access, and the implications of such a PVR attack may be more than just inconvenient but in fact catastrophic for millions of Canadians. As the benefit of cybercrime exceed the costs of the effort, we will only see more attacks.As an alternative, it is important to understand that the entire financial and supply chain sector are moving to re-invent global systems using blockchain technology as a basis, eliminating the need for intermediaries, increasing trust, and saving billions in costs. Similar to the financial sector, foundational blockchain technology may hold promise to better protect a national PVR under consumer mediated access and data exchange.Trust is the key to blockchain—the “chain of trust.” Blockchain establishes trust and identity without intermediaries via a trusted distributed ledger. Contents of the blockchain ledger would point to each vaccination record for a consumer, regardless of provider or province, collectively forming the PVR. Blockchain uses public key cryptographic techniques to create an append-only, immutable, timestamped chain of ledger entries, in our case, vaccination entries. These ledger entries are grouped together in a protected block, timestamped and added to a chain in a linear, chronological order, rendering the content impossible to hack. Copies of the blockchain (ledger) are distributed on specific nodes in the network (e.g. each province), obsoleting the need to trust a single intermediary, creating a “trustless” model.By re-thinking a national PVR based upon an immutable blockchain ledger and a consumer mediated health data exchange, we will enable the free flow of health data that can be trusted by consumers. Consumer mediated consent will become an "asset," trumping current privacy laws, and moving PHI from under provider targeted privacy laws to consumer-centric control, without creating a solution based on centralized "trust me" models and intermediaries. Consumers will register consent in the blockchain PVR ledger to allow their "circle of care" or other designated participants (e.g. an airline carrier) access to information required for care, research (use of their anonymized data), employment or international travel. In the future, a blockchain distributed healthcare ledger may expand to allow consumer mediated exchange of PHI across the entire healthcare domain, enable secure connection to many IOT medical devices, and address the vast percentage of health related data outside current systems of record, such as genomic data and environmental and behavioural information.Clearly, expediency driven by the pandemic may lead to a phase one PVR based on traditional intermediaries. However, the critical nature of an immutable PVR in a pandemic world shapes an imperative for a next phase PVR based on blockchain technology. Emerging from this phase, Canada may then begin to redesign our healthcare data delivery and research infrastructure and a healthcare "chain of trust."Paul Sulkers has over 45 years experience with digital health, most recently with IBM Health, now focusing on population health and primary care transformation.

Using blockchain to create national personal vaccination records

Register for free access or login.

Related Topics