A Hybrid Framework for Dynamic Patient Consent Management using Blockchain and OAuth 2.0

Abstract

Over the years, managing patient consent for sharing health data has remained a significant challenge due to a lack of transparency about how the data is shared with other systems and the absence of a verifiable audit trail. This paper introduces a new hybrid design that uses an industry-standard Open Authorization (OAuth) 2.0 authorization framework for detailed access grants, complemented by a decentralized, on-chain consent ledger built on the ERC-6551 blockchain standard, enabling digital assets (using Non Fungible Tokens) to act as independent accounts. The primary concept behind this paper is the utilization of the ERC-6551 Token Bound Account (TBA) as a patient-controlled on-chain portfolio of consent grant tokens, which are represented as semi-fungible tokens. We have solved the problem of converting the static, database-bound permissions into a dynamic, patient-owned digital system supported by timely-expiring JWT tokens. With the utilization of the OAuth 2.0 flow, short-lived JSON Web Tokens (JWTs) act as pointers to the durable, immutable consent records on the Blockchain. With our dual-validation approach, resource servers can verify both the off-chain time-based short-lived tokens and the granted access, along with on-chain consent status, to determine whether the patient has revoked the token. This provides a robust, auditable, and patient-sovereign system for managing healthcare data access. Finally, we present the complete design and architecture, along with data flows and cryptographic operations, which we used to analyze the security and performance characteristics and evaluate the outcomes of this implementation.