Healthcare Record Release and Minimum Disclosure

Protect patient records, imaging, and regulated clinical files with controlled release, audit-friendly access reasons, and permanent evidence of what was shared.

Encrypted electronic health records stored permanently on Arweave. Every access, every update, every modification linked in an immutable blockchain audit chain - HIPAA-ready by design.

Medical records that cannot be erased.

Healthcare data is broken by design.

Key challenges

Healthcare data breaches are rising

Traditional healthcare data storage relies on centralised EHR databases - SQL servers, file systems, cloud buckets - all of which are high-value targets. A single breach exposes millions of patient records.

Compliance requirements are complex

HIPAA mandates privacy, security, and breach notification requirements for Protected Health Information (PHI). The system must provide access controls, audit trails, and encryption - across every environment.

Audit trails are easily tampered

Most healthcare systems log access events to a database that can be altered or deleted by a privileged user or attacker. An audit trail in a mutable store is not a legally defensible audit trail.

How Evercore solves it.

Solution

EHR encrypted before leaving your infrastructure

The raw patient record is encrypted with AES-256-GCM on your server using a key derived from your Evercore API credentials. The ciphertext is what gets uploaded - not the plaintext. Evercore never sees the unencrypted record.

Stored on the Arweave permaweb

The encrypted blob is posted to Arweave - a decentralised, permanent storage network. Arweave protocol economics ensure the data is stored for a minimum of 200 years. There is no SLA to negotiate, no vendor to issue a deletion order to.

Every modification creates an immutable audit event

When a record is updated, a new Arweave transaction is created with a Parent-TX tag linking to the previous version. The chain persists on the blockchain - it cannot be modified, truncated, or deleted. Each entry is timestamped by block height.

Access is gated by cryptographic auth scopes

The Evercore API uses bearer tokens with granular scopes. A clinician's token might hold files:read only. Admins with files:write can upload. Auditors with versions:read can traverse the history chain. No shared credentials, no standing access.

Chain-native guarantees for regulated health data.

Ciphertext on Arweave, keys and policy in your infrastructure - the API encrypts and posts; you keep control of who can decrypt.

  • No plaintext on L1: Only AES-256-GCM ciphertext is posted. Arweave stores opaque blobs; PHI never touches validator-visible state in readable form.
  • Consensus timestamps: Block height binds every upload to a global clock - useful for breach timelines, legal holds, and proving when a record existed.
  • Immutable version DAG: Parent-TX links form an append-only graph of amendments. No admin can rewrite history without generating a new, publicly visible transaction.
  • Wallet-grade access: Scoped API tokens behave like capability keys: least privilege per integration, rotatable without touching on-chain data.

Does storing EHRs on a public blockchain violate HIPAA?

The permaweb stores ciphertext, not plaintext PHI. AES-256-GCM encrypted data with keys never stored on-chain satisfies the HIPAA encryption safe harbor. Your BAA with Evercore covers the upload process.

Can a patient request deletion of their records?

Arweave data is immutable by protocol - records cannot be deleted once confirmed. HIPAA Right of Access and Right of Correction can be satisfied by creating amended versions with correction metadata tags, while the original remains on-chain for audit purposes.

What happens if my Evercore subscription lapses?

Data on Arweave is yours permanently. You can retrieve any file using its TX ID directly from any Arweave gateway - no Evercore access required. TX IDs should be stored in your own records management system as a backup reference.