Research paper

Blockchain innovation for consent self-management in health information exchanges

Having established patients' desire to self-manage consent, the paper proposes a permissioned-blockchain solution enabling seamless sharing of patient consent across providers and HIEs, formalized through five design requirements, five design principles and five design features, and evaluated with a prototype.

Paper

Overview

Publication metadata and narrative from the current library record.

Authors: Chad Anderson, Arthur Carvalho, Mala Kaul, Jeffrey W. Merhout
Year: 2023
Venue: Decision Support Systems 174 (2023) 114021
Methodology: Design science research; patient survey of willingness to self-manage consent; instantiated prototype; quantitative evaluation.
DOI: 10.1016/j.dss.2023.114021
Design knowledge: View design knowledge on GitHub

blockchainconsent-managementconsent-self-management-hiedesign-science-researchhealthcareinteroperabilityprivacy

Summary

Artifact

A blockchain-based, self-managed patient consent system for health information exchanges (HIEs).

Methodology

Design science research; patient survey of willingness to self-manage consent; instantiated prototype; quantitative evaluation.

DSR grid

Six dimensions represented in the current paper record.

Problem description

Patients lack effective means to self-manage consent for sharing protected health information, and interoperability gaps and regulatory heterogeneity across health information exchanges (HIEs) compound the problem.

Input knowledge

Digital patient-consent-management literature; trust; decision models for assessing blockchain suitability; HIE architectures and regulation.

Research process

Design science research: a survey of patients' willingness to self-manage consent, followed by an instantiated prototype and quantitative evaluation.

Key concepts

Patient consent, health information exchange, blockchain, protected health information, trust.

Solution description

A permissioned-blockchain, self-managed patient consent system enabling seamless cross-HIE sharing of consent. Solution-space representation: Instantiation (prototype) plus design principles (nascent design theory).

Output knowledge

Five design requirements, five design principles, and five design features for patient consent self-management across HIEs.

Paper design map

The default semantic design map canonicalizes stored design relationships; Raw links retains the complete technical Markdown-link view.

Design-knowledge map

15 stored concepts / 16 canonical semantic relationships

Concept types

Show relationship labels

Design knowledge

Directly linked concepts, grouped by their represented design-knowledge category.

5 Design Features

design-knowledge/consent-self-management-hie-df1

DF1 - Encryption

Blockchain wallets store and seamlessly use private keys to digitally sign blockchain transactions, providing encryption for consent transactions.

consent-managementconsent-self-management-hiedesign-featurehealthcare+2

design-knowledge/consent-self-management-hie-df2

DF2 - Key management

Blockchain wallets manage the cryptographic keys that authenticate users and facilitate the creation of blockchain transactions.

consent-managementconsent-self-management-hiedesign-featurehealthcare+2

design-knowledge/consent-self-management-hie-df3

DF3 - Immutability

Consent transactions are never erased; a previous transaction remains, and any change is added as a new transaction to the append-only blockchain data structure.

consent-managementconsent-self-management-hiedesign-featurehealthcare+2

design-knowledge/consent-self-management-hie-df4

DF4 - Decentralization

A user can connect and submit a consent transaction to a single HIE without the need for a central, trusted entity to mediate the exchange.

consent-managementconsent-self-management-hiedesign-featurehealthcare+2

design-knowledge/consent-self-management-hie-df5

DF5 - Distribution

A consent transaction submitted to a single HIE is shared with all blockchain network nodes (HIEs), eventually becoming available to all HIEs.

consent-managementconsent-self-management-hiedesign-featurehealthcare+2

5 Design Principles

design-knowledge/consent-self-management-hie-dp1

DP1 - Authorization-restricted consent visibility

Only HIEs and providers with authorization can view a patient's consent status, maintaining confidentiality.

consent-managementconsent-self-management-hiedesign-principlehealthcare+2

design-knowledge/consent-self-management-hie-dp2

DP2 - Patient-only consent changes

Only the patient can change their consent status, supporting self-management and engendering patient trust.

consent-managementconsent-self-management-hiedesign-principlehealthcare+2

design-knowledge/consent-self-management-hie-dp3

DP3 - Auditable consent history

The history of consent transactions between patients and the HIE must be auditable so that compliance with consent laws can be verified for all transactions.

consent-managementconsent-self-management-hiedesign-principlehealthcare+2

design-knowledge/consent-self-management-hie-dp4

DP4 - Cross-HIE consent communication without central authority

HIEs should be able to communicate consent status across HIEs without a central authority, supporting interoperability.

consent-managementconsent-self-management-hiedesign-principlehealthcare+2

design-knowledge/consent-self-management-hie-dp5

DP5 - Patient-driven cross-HIE consent updates

Enable patients to share changes in their consent status across HIEs.

consent-managementconsent-self-management-hiedesign-principlehealthcare+2

5 Design Requirements

design-knowledge/consent-self-management-hie-dr1

DR1 - Privacy

Patient consent self-management must support patients' privacy preferences, since the exposure of protected health information to unauthorized entities can be detrimental to patients and healthcare organizations are federally mandated to secure PHI privacy under HIPAA.

consent-managementconsent-self-management-hiedesign-requirementhealthcare+2

design-knowledge/consent-self-management-hie-dr2

DR2 - Self-management

The solution must support patients' self-management of their own consent data, reflecting patients' rights to notice, access, and consent over the collection, use and disclosure of their personal data.

consent-managementconsent-self-management-hiedesign-requirementhealthcare+2

design-knowledge/consent-self-management-hie-dr3

DR3 - Trust

The solution must build and maintain patient trust in health information exchange by giving patients control over and visibility into their consent relationships, since patient trust is critical to the rights patients have to control the sharing of their protected health information.

consent-managementconsent-self-management-hiedesign-requirementhealthcare+2

design-knowledge/consent-self-management-hie-dr4

DR4 - Compliance

The solution must have the flexibility to comply with the variable body of federal and state regulatory rules governing patient consent for PHI sharing, since healthcare providers must comply with these regulations for the patient data they manage.

consent-managementconsent-self-management-hiedesign-requirementhealthcare+2

design-knowledge/consent-self-management-hie-dr5

DR5 - Interoperability

The solution must be interoperable across the currently fragmented health information exchange infrastructure to enable full self-management of consent, since the range of HIE organizational forms is each designed to support connectivity for only a limited set of entities.

consent-managementconsent-self-management-hiedesign-requirementhealthcare+2

Publication metadata

Additional metadata represented in the current library record.

Show additional metadata

{
  "type": "paper",
  "title": "Blockchain innovation for consent self-management in health information exchanges",
  "description": "Having established patients' desire to self-manage consent, the paper proposes a permissioned-blockchain solution enabling seamless sharing of patient consent across providers and HIEs, formalized through five design requirements, five design principles and five design features, and evaluated with a prototype.",
  "resource": "https://doi.org/10.1016/j.dss.2023.114021",
  "authors": "Chad Anderson, Arthur Carvalho, Mala Kaul, Jeffrey W. Merhout",
  "year": 2023,
  "venue": "Decision Support Systems 174 (2023) 114021",
  "methodology": "Design science research; patient survey of willingness to self-manage consent; instantiated prototype; quantitative evaluation.",
  "dsr_grid": true,
  "dsr_solution_space": "Instantiation (prototype) plus design principles (nascent design theory).",
  "tags": [
    "consent-self-management-hie",
    "healthcare",
    "consent-management",
    "privacy",
    "interoperability",
    "design-science-research",
    "blockchain"
  ]
}