Blockchain Smart Contract EHR

Question

I'm trying to do a miny EHR(Electronical Health Record) with Smart Contracts where I have a Pacient Contract.

The problem is that in solidity everything is public, even the private variables, so I got to crypt the health record data in some way, but in other way it should be available for other doctors to read my previous health record and add some new data to one specific Pacient contract, so the doctor need to have a mechanism to decrypt and to encrypt the data, and also the pacient should be able to see his data.

Every pacient will have an account and with that account should register a Pacient Contract where he can crypt all his personal data with his private key. The doctors will have an account just to be able to make transactions(in this case a transaction will be writing some health data into Pacient Smart Contract)

My approach:

1. All medical data from a Pacient Contract will be crypter/encrypted with pacient private key.
2. When a pacient go to a doctor, he need to give his private key in order to let the doctor to his previous medical data and write more medical data into his contract.

The ugly part of this approach is that all the time the pacient will need to give his private key to doctor, and then the doctor can access any time pacient data.

Is there other approach to keep sensitive data into public blockchain, or a more elgant solution to EHR dApp?

Answer 1

In Patient's contract, you can add rules such that who can add data to his/her existing medical record:

For Example:
Patient.sol
contract Patient {
         mapping(address=>doctorStruct[]) public doctorDetails;
         struct doctorStruct {
             address doctorAccountAddr;
             bool canAddData;
         }
}

Here, instead of sharing the private key with the doctor, the patient can ask for the doctor's public key (account address) and add that into the Patient.sol's doctorDetails. Next, whenever the doctor wants to add data, just ensure doctorDetails[docAddress].canAdd = true

This will be a good starting point to get well versed with Solidity Smart contracts: https://solidity.readthedocs.io/en/v0.5.4/

Once you get a good hands-on Solidity, then you will be able to manage everything at the contract level without the need for encryption/decryption.(My take)

Answer 2

One option would be to move to a private, permissible blockchain, but I am not sure this what you want to do.

In your case I would build a dApp that handles the permissions.