Tracking Decisions about Granting Access to Health Data: Application Analysis and Requirements

Abstract

Medical research often requires access to sensitive personal health data. According to GDPR, such access is only possible under certain legal bases, such as consent. Verifiable and secure management of health data access is thus essential for promoting public trust in organizations that manage sensitive health data, for ensuring legal compliance, as well as for motivating patients to participate in research projects and allow access to their health data. In this work, we advocate a blockchain-based approach for verifiable management of sensitive health data access for medical research. We present the life cycle of a medical research project w.r.t. health data access, by identifying the involved entities and their interactions. Important requirements for verifiable management of health data access are also identified. We believe that the advocated approach will contribute to satisfying the identified requirements in the context of the defined life cycle.