Smart contracts offer a very innovative and secure solution to COVID-19 testing and data management. Such a solution can maintain desired levels of privacy, while allowing health providers or any other third party who are part of the network to securely view actual results or anonymized patterns and trends that can be used for managing the response strategies. Smart Contracts linked to Verifiable Credentials (a set of tamper-evident claims and metadata that cryptographically proves who issued it)  can also be used for consumers to be in control of their data regarding test or vaccine status and validity period. It also provides them with an ability to share this data in a secure and trusted way with others.

I’ll start by outlining the problem statement of having reliable medical test data available in order to perform analysis of infection rates, and also to manage the supply of any medical related supplies . Then I will outline a solution concept using smart contracts and verifiable credentials (a new W3C standard)  Finally, I will attempt to address some legitimate concerns around privacy and suitability of blockchain technology for this purpose. Thanks to Manish Grover from Digital Asset for his insights and inputs to this blog.

An Overview of Challenges

COVID-19 testing is fragmented across providers - medical facilities, labs, and software systems that provide digital interfaces to your results. You must submit screening information, be approved, take the test, and then get your results through a phone call or other paper-based means in several days. Although there may be in some jurisdictions still some regulatory hurdles, providing a digital experience for getting medical test results is nowadays the minimum digital experience that consumers want.  

The process of data collection, de-identification, and then propagating the data to CDC and the multiple state and local agencies is complex. It involves the use of multiple systems, different data file formats, and numerous places (think about pop-test centers)  where data must be matched and cleaned.

The constant transfer of data back and forth between so many different systems and applications is cumbersome, leads to multiple copies of data and various compliance challenges. Results have to be reported daily to the State Health agencies and other government agencies that can provide aggregated metrics to the public, while also planning for the most appropriate response strategies.

Consider now the supply chain and response management challenges. As providers and manufacturers try to make the right healthcare equipment and supplies available at the right time at the right place, responding to demand quickly is important. And as demand patterns change, sourcing these supplies from the right suppliers is challenging because they must be certified and on-boarded first. This problem was covered very well in this blog by Innover that focused on supply chain aspects of which matching demand based on testing patterns to supply was covered as well. Needless to say, we need robust solutions to manage our response that includes distribution of supplies and vaccines to the right places at the right time without having to cope with data quality issues as well.

Finally, let’s review citizen level aspects. Even though there is a debate around using technology to manage this, there is no doubt that so long as we can put the right guardrails around privacy and uniform accessibility then allowing consumers to be able to access and manage their testing results in a place that they can control is a good premise. When a citizen can be self sovereign over their own data without the need to access a myriad of healthcare providers, then it is maybe a step in the right direction 

A Solution Using Daml Smart Contracts & W3C Verifiable Credentials

As I outline the solution, I’m going to lean on 2 salient properties of Daml that will hopefully alleviate most concerns around using this technology:

1. Daml guarantees privacy by way of rights and obligations. Data is stored so that it cannot be accessed unless the party accessing that data has been explicitly configured in the smart contracts to access it. This makes it very effective to avoid common database programming errors, and more easily meet compliance needs such as HIPAA.  

2. Daml is interoperable across networks. So it means that multiple institutional entities need not make the same technology choices but still be able to atomically transact across enterprise boundaries without incurring the overhead of maintaining multiple data islands.   

Here is how the overall business process flow looks like.

This is how an Operator would onboard all the various parties. The parties will have an option to accept their registration into the system.

There are distinct advantages to such a solution. Smart contracts keep each party in control of their data, and enable them to access a single version of the truth kept in sync by Daml across one or multiple networks as setup.

For example, here is how the citizens have been granted the right to request a test on their role contract.

And the health clinic can look up their records and accept the test request, thus generating an appointment. The operator of the network is an optional observer on this process (this feature can also be used for regulatory compliance and reporting purposes).

Furthermore, the fact that such a network can be operated by a state agency as a trusted operator, allows for the immense technology simplicity of running this entire smart contracts system in a centralized manner, further improving governance and management of the network. 

Here is what the health clinic role may look like, indicating that a health clinic may not be registered without the operators approval:

Imagine also if our data can be stored in a way that is also GDPR compliant by storing proofs on the ledger (database or blockchain), and storing the actual personally identifiable data on a system that is still controlled by smart contracts but now can be made to comply with citizen requests for removal of their records as legally permissible. The possibilities are endless in how this system can be configured to meet the needs of the various parties. Due to the transparency of data lineage, and the fact that data contracts cannot be created without consent and required disclosures, it is also possible to streamline compliance to HIPAA regulations.

In this solution, we also built in the integration with Trinsic, a verifiable credentials app based on the W3C’s standards. It’s up to the consumer to connect their app to this network voluntarily, thus being able to produce their credentials on demand, in the manner they find most suitable.  

Citizens can be identified in the traditional way or by mean of a DID (Decentralized Identity). 

Here is how a health clinic (or the operator as required) can send the verifiable credentials to the citizens, who have already connected their app (Trinsic in this case) to the network. 

The actual results of the Covid19 Tests and in the future Vaccines Proofs are sent as a “Verifiable Credential” which is a secure and safe mechanism to send information between an 

1. an issuer (Health Care facility)
2. a holder (the citizen like you and me) and 
3. a verifier (any other third party that is interested to know the results). 

In this case once received from the issuer,  the holder can specify what information is disclosed and the verifier can independently check the accuracy of the information. The integration with Trinsic is done through a secure API, while the audit log is kept on the ledger, for any forensic analysis that may be required later.

Summary

I hope this was a view into how we can dramatically streamline healthcare processes. The use of Daml smart contracts allows us to configure privacy and data safety as appropriate. 

Moreover, this approach eliminates the need for expensive data reconciliations and latencies which will lead to simplified technology architectures, better compliance, and more responsive response strategies.

References:

1. For more information on Verifiable Credentials - check out Trinsic
2. Video demo of this solution
3. Download Daml 
4. Checkout Daml Hub here for hosting your Daml app.