Patient-Centric Secure Medical Record Sharing on Ethereum: A Proof-of-Concept Study of Smart Contract-Based Access Control

Abstract

Fragmented electronic medical records (EMRs) across healthcare institutions hinder coordinated care and increase cybersecurity risks for sensitive patient data. While blockchain has been proposed for medical data governance, existing architectures remain often overly complex and lack minimal, verifiable implementations. This paper presents a proof-of-concept (PoC) using a minimal Ethereum smart contract to enforce patient-centric authorization and provide tamper-evident audit logs for EMR references without storing clinical data chain. Through analysis of prior systems (MedRec, FHIRChain, ACTION-EHR) and a Solidity implementation, its is demonstrated that deterministic on-chain execution can effectively manage access control lists (ACLs) and log access events. The PoC implements three core functions—setRecord, grantAccess, and getRecord—and validates them against core requirements: authorized access, denial for unauthorized users, and immutable event logging. Evaluation confirms the contract delivers transparent governance but exposes key limitations: poor scalability, weak privacy engineering, smart contract security risks, and missing real-world capabilities like access revocation and emergency override. Findings show that Ethereum smart contracts can serve as a complementary authorization and audit layer for EMR sharing, but not as replacement for interoperability standards (e.g., HL7 FHIR) or conventional security controls.