CoChat
Sign Up
Cited by 53Blockchain Technology Applications and SecurityElectronic Health Records SystemsThoreau and American Literature

The DOI matches its Crossref record; 10 of the 10 references it cites were found in a registry or an index.

Advancing Compliance with HIPAA and GDPR in Healthcare: A Blockchain-Based Strategy for Secure Data Exchange in Clinical Research Involving Private Health Information

Open access
Barbaria, Sabri, Jemai, Abderrazak, Ceylan, Halil İbrahim, Muntean, Raul Ioan, Dergaa, Ismail, Boussi Rahmouni, Hanene·2025·Healthcare
DOI 10.3390/healthcare13202594PMC PMC12563691
Open this paper in CoChat — free accountOpen PDF

Abstract

Background: Healthcare data interoperability faces significant barriers, including regulatory compliance complexities, institutional trust deficits, and technical integration challenges. Current centralized architectures demonstrate inadequate mechanisms for balancing data accessibility requirements with patient privacy protection, as mandated by HIPAA and GDPR frameworks. Traditional compliance approaches rely on manual policy implementation and periodic auditing, which are insufficient for dynamic, multi-organizational healthcare data-sharing scenarios. Objective: This study develops and proposes a blockchain-based healthcare data management framework that leverages Hyperledger Fabric, IPFS, and the HL7 FHIR standard and incorporates automated regulatory compliance mechanisms via smart contract implementation to meet HIPAA and GDPR requirements. It assesses the theoretical system architecture, security characteristics, and scalability considerations. Methods: We developed a permissioned blockchain architecture that employs smart contracts for privacy policy enforcement and for patient consent management. The proposed system incorporates multiple certification authorities for patients, hospitals, and research facilities. Architectural evaluation uses theoretical modeling and system design analysis to assess a system’s security, compliance, and scalability. Results: The proposed framework demonstrated enhanced security through decentralized control mechanisms and cryptographic protection protocols. Smart contract-based compliance verification can automate routine regulatory tasks while maintaining human oversight in complex scenarios. The architecture supports multi-organizational collaboration with attribute-based access control and comprehensive audit-trail capabilities. Conclusions: Blockchain-based healthcare data-sharing systems provide enhanced security and decentralized control compared with traditional architectures. The proposed framework offers a promising solution for automating regulatory compliance. However, implementation considerations—including organizational readiness, technical complexity, and scalability requirements—must be addressed for practical deployment in healthcare settings.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.3390/healthcare13202594

Cites

10 of 10 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Data governance incorporating HIPAA and GDPR compliance through blockchain-based security architecture addresses the data protection requirements that apply to any AI system processing personal health information.

    “Data governance incorporating HIPAA and GDPR compliance through blockchain-based security architecture (Barbaria et al., 2025) addresses the data protection requirements that apply to any AI system processing personal health information.”

    From A generative AI multi-agent framework with integrated XAI governance for cancer diagnostics: from multi-omics interpretation to lifestyle risk stratification (2026) · cites this paper as Barbaria et al., 2025

    Sections 4.2 and 5.2 describe a blockchain framework that incorporates HIPAA and GDPR compliance measures for healthcare data sharing. The paper does not establish that it addresses the requirements applicable to any AI system processing personal health information. Section 3.1 also says the initial smart-contract logic primarily addresses HIPAA research provisions, with further GDPR provisions left for future integration. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

  • Federated learning architectures allow multi-site validation without requiring centralized aggregation of protected health information, preserving patient privacy while enabling the sample diversity needed to assess cross-population generalizability.

    “Federated learning architectures allow multi-site validation without requiring centralized aggregation of protected health information, preserving patient privacy while enabling the sample diversity needed to assess cross-population generalizability (Barbaria et al., 2025).”

    From A generative AI multi-agent framework with integrated XAI governance for cancer diagnostics: from multi-omics interpretation to lifestyle risk stratification (2026) · cites this paper as Barbaria et al., 2025

    Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.

    Experimental — accuracy not yet measured

  • Data governance and privacy compliance for the framework draw on blockchain-based HIPAA and GDPR frameworks developed and validated by the research team.

    “Data governance and privacy compliance draw on blockchain-based HIPAA and GDPR frameworks developed and validated by the same team”

    From A generative AI multi-agent framework with integrated XAI governance for cancer diagnostics: from multi-omics interpretation to lifestyle risk stratification (2026) · cites this paper as Barbaria et al., 2025

    Section 3.1 (Compliance Approach; page not provided) describes the team's blockchain-based framework for HIPAA and GDPR, but says the smart-contract logic primarily addresses HIPAA and further GDPR provisions are for future integration. Section 3.4 (Performance and Scalability Considerations; page not provided) proposes empirical validation as future work, so the claim that the frameworks were already validated is not supported. (LLM, conf=0.90)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 61

  1. Kruse, 2017, Cybersecurity in healthcare: A systematic review of modern threats and trends, Technol. Health Care, 25, 1, 10.3233/THC-161263 · DOI
  2. Kumar, T., Ramani, V., Ahmad, I., Braeken, A., Harjula, E., and Ylianttila, M. (2018, January 17–20). Blockchain utilization in healthcare: Key requirements and challenges. Proceedings of the 2018 IEEE 20th International Conference on e-Health Networking, Applications and Services (Healthcom), Ostrava, Czech Republic. · DOI
  3. Razdan, 2022, Internet of medical things (IoMT): Overview, emerging technologies, and case studies, IETE Tech. Rev., 39, 775, 10.1080/02564602.2021.1927863 · DOI
  4. Jha, 2017, HITECH Act drove large gains in hospital electronic health record adoption, Health Aff., 36, 1416, 10.1377/hlthaff.2016.1651 · DOI
  5. Kellermann, 2013, What it will take to achieve the as-yet-unfulfilled promises of health information technology, Health Aff., 32, 63, 10.1377/hlthaff.2012.0693 · DOI
  6. Esmaeilzadeh, P. (2020). Use of AI-based tools for healthcare purposes: A survey study from consumers’ perspectives. BMC Med. Inform. Decis. Mak., 20. · DOI · Paper page
  7. Davis, 1989, User acceptance of computer technology: A comparison of two theoretical models, Manag. Sci., 35, 982, 10.1287/mnsc.35.8.982 · DOI · Paper page
  8. Haque, 2021, GDPR compliant blockchains–a systematic literature review, IEEE Access, 9, 50593, 10.1109/ACCESS.2021.3069877 · DOI
  9. Act, 1996, Health insurance portability and accountability act of 1996, Public Law, 104, 191
  10. Nosowsky, 2006, The Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy rule: Implications for clinical research, Annu. Rev. Med., 57, 575, 10.1146/annurev.med.57.121304.131257 · DOI
  11. Elkourdi, 2024, Exploring current practices and challenges of HIPAA compliance in software engineering: Scoping review, IEEE Open J. Syst. Eng., 2, 94, 10.1109/OJSE.2024.3392691 · DOI
  12. Jeyaraman, 2024, Regulatory challenges and frameworks for fog computing in healthcare, Cureus, 16, e66779
  13. Khan, 2025, Advancing medical innovation through blockchain-secured federated learning for smart health, IEEE J. Biomed. Health Inform., 29, 6482, 10.1109/JBHI.2025.3532976 · DOI
  14. Oh, J., Son, S., Kwon, D., Kim, M., Park, Y., and Park, Y. (2024). Design of secure and privacy-preserving data sharing scheme based on key aggregation and private set intersection in medical information system. Mathematics, 12. · DOI
  15. Coventry, 2018, Cybersecurity in healthcare: A narrative review of trends, threats and ways forward, Maturitas, 113, 48, 10.1016/j.maturitas.2018.04.008 · DOI
  16. Zhang, 2018, FHIRChain: Applying blockchain to securely and scalably share clinical data, Comput. Struct. Biotechnol. J., 16, 267, 10.1016/j.csbj.2018.07.004 · DOI · Paper page
  17. Bender, D., and Sartipi, K. (2013, January 20–22). HL7 FHIR: An Agile and RESTful approach to healthcare information exchange. Proceedings of the 26th IEEE International Symposium on Computer-Based Medical Systems, Porto, Portugal. · DOI · Paper page
  18. Mandl, 2001, Public standards and patients’ control: How to keep electronic medical records accessible but private Medical information: Access and privacy Doctrines for developing electronic medical records Desirable characteristics of electronic medical records Challenges and limitations for electronic medical records Conclusions Commentary: Open approaches to electronic patient records Commentary: A patient’s viewpoint, BMJ, 322, 283, 10.1136/bmj.322.7281.283 · DOI
  19. Agrawal, 2021, Blockchain-based framework for supply chain traceability: A case example of textile and clothing industry, Comput. Ind. Eng., 154, 107130, 10.1016/j.cie.2021.107130 · DOI
  20. Paulk, M.C., Curtis, B., Chrissis, M.B., and Weber, C.V. (1993). Capability Maturity Model, IEEE Software. version 1.1. · DOI
  21. Nakamoto, S. (2008). Bitcoin: A peer-to-peer electronic cash system. Available SSRN 3440802.
  22. Hawlitschek, 2020, A 2020 perspective on “The limits of trust-free systems: A literature review on blockchain technology and trust in the sharing economy”, Electron. Commer. Res. Appl., 40, 100935, 10.1016/j.elerap.2020.100935 · DOI
  23. Stach, 2022, Assessment and treatment of privacy issues in blockchain systems, ACM SIGAPP Appl. Comput. Rev., 22, 5, 10.1145/3570733.3570734 · DOI
  24. Ghesmati, S., Fdhila, W., and Weippl, E. (2022, January 2–6). User-perceived privacy in blockchain. Proceedings of the International Conference on Financial Cryptography and Data Security, Grand Anse, Grenada. · DOI
  25. Marthews, 2023, What blockchain can and can’t do: Applications to marketing and privacy, Int. J. Res. Mark., 40, 49, 10.1016/j.ijresmar.2022.09.001 · DOI
  26. Zhang, 2022, An efficient blockchain-based hierarchical data sharing for healthcare internet of things, IEEE Trans. Ind. Inform., 18, 7139, 10.1109/TII.2022.3145851 · DOI
  27. Stefanescu, 2022, A systematic literature review of lightweight blockchain for IoT, IEEE Access, 10, 123138, 10.1109/ACCESS.2022.3224222 · DOI
  28. Harshini Poojaa, K., and Ganesh Kumar, S. (2022). Scalability challenges and solutions in blockchain technology. Inventive Computation and Information Technologies: Proceedings of ICICIT 2021, Springer. · DOI
  29. Nasir, 2022, Scalable blockchains—A systematic review, Future Gener. Comput. Syst., 126, 136, 10.1016/j.future.2021.07.035 · DOI
  30. Pradhan, 2022, Author Correction: A blockchain based lightweight peer-to-peer energy trading framework for secured high throughput micro-transactions, Sci. Rep., 12, 21017, 10.1038/s41598-022-25504-8 · DOI
  31. Qiu, 2022, A distributed and privacy-aware high-throughput transaction scheduling approach for scaling blockchain, IEEE Trans. Dependable Secur. Comput., 20, 4372, 10.1109/TDSC.2022.3216571 · DOI
  32. Wu, 2023, FabricETP: A high-throughput blockchain optimization solution for resolving concurrent conflicting transactions, Peer-Peer Netw. Appl., 16, 858, 10.1007/s12083-022-01401-9 · DOI
  33. Barbaria, 2023, A novel blockchain-based architectural modal for healthcare data integrity: Covid19 screening laboratory use-case, Procedia Comput. Sci., 219, 1436, 10.1016/j.procs.2023.01.433 · DOI
  34. Pal, 2022, Blockchain for IoT access control: Recent trends and future research directions, J. Netw. Comput. Appl., 203, 103371, 10.1016/j.jnca.2022.103371 · DOI
  35. Roosan, 2022, Framework to enable pharmacist access to health care data using Blockchain technology and artificial intelligence, J. Am. Pharm. Assoc., 62, 1124, 10.1016/j.japh.2022.02.018 · DOI
  36. Omar, I.A., Jayaraman, R., Salah, K., Simsekler, M.C.E., Yaqoob, I., and Ellahham, S. (2020). Ensuring protocol compliance and data transparency in clinical trials using Blockchain smart contracts. BMC Med. Res. Methodol., 20. · DOI
  37. Munir, 2021, An ontology-based compliance audit framework for medical data sharing across Europe, Int. Arab J. Inf. Technol. (IAJIT), 18, 158
  38. Vegoda, 1987, Introduction to hospital information systems, Int. J. Clin. Monit. Comput., 4, 105, 10.1007/BF02915853 · DOI
  39. Sushma, 2023, Healthcare 4.0: A review of phishing attacks in cyber security, Procedia Comput. Sci., 230, 874, 10.1016/j.procs.2023.12.045 · DOI
  40. Kumar, 2023, Blockchain inspired secure and reliable data exchange architecture for cyber-physical healthcare system 4.0, Internet Things Cyber-Phys. Syst., 3, 309, 10.1016/j.iotcps.2023.05.006 · DOI
  41. Khatri, 2021, A systematic analysis on blockchain integration with healthcare domain: Scope and challenges, IEEE Access, 9, 84666, 10.1109/ACCESS.2021.3087608 · DOI
  42. Khatoon, A. (2020). A blockchain-based smart contract system for healthcare management. Electronics, 9. · DOI
  43. Sharma, A., Tomar, R., Chilamkurti, N., and Kim, B.-G. (2020). Blockchain based smart contracts for internet of medical things in e-healthcare. Electronics, 9. · DOI
  44. Regulation, 2018, General data protection regulation, Intouch, 25, 1
  45. Bakare, 2024, Data privacy laws and compliance: A comparative review of the EU GDPR and USA regulations, Comput. Sci. IT Res. J., 5, 528, 10.51594/csitrj.v5i3.859 · DOI
  46. Kammueller, F. (2018, January 7–10). Formal modeling and analysis of data protection for GDPR compliance of IoT healthcare systems. Proceedings of the 2018 IEEE International Conference on Systems, Man, and Cybernetics (SMC), Miyazaki, Japan. · DOI
  47. Wang, Q., and Qin, S. (2021). A hyperledger fabric-based system framework for healthcare data management. Appl. Sci., 11. · DOI
  48. Solaiman, 2021, Implementation and evaluation of smart contracts using a hybrid on- and off-blockchain architecture, Concurr. Comput. Pract. Exp., 33, e5811, 10.1002/cpe.5811 · DOI
  49. He, 2024, Enhancing smart contract security: Leveraging pre-trained language models for advanced vulnerability detection, IET Blockchain, 4, 543, 10.1049/blc2.12072 · DOI
  50. Chowdhary, A., Huang, D., Mahendran, J.S., Romo, D., Deng, Y., and Sabur, A. (2020, January 17–19). Autonomous security analysis and penetration testing. Proceedings of the 2020 16th International Conference on Mobility, Sensing and Networking (MSN), Tokyo, Japan. · DOI
  51. Jones, 2021, A landscape survey of planned SMART/HL7 bulk FHIR data access API implementations and tools, J. Am. Med. Inform. Assoc., 28, 1284, 10.1093/jamia/ocab028 · DOI
  52. Ravuri, A., Sendil, M.S., Rani, M., Srikanth, A., Sharath, M., Sudarsa, D., and Gupta, K.G. (2024, January 28–30). Blockchain-enabled collaborative anomaly detection for IoT security. Proceedings of the MATEC Web of Conferences, Glasgow, Scotland. · DOI
  53. Sukhwani, H., Wang, N., Trivedi, K.S., and Rindos, A. (2018, January 1–3). Performance modeling of hyperledger fabric (permissioned blockchain network). Proceedings of the 2018 IEEE 17th International Symposium on Network Computing and Applications (NCA), Cambridge, MA, USA. · DOI · Paper page
  54. Ante, L., and Saggu, A. (2024). Time-varying bidirectional causal relationships between transaction fees and economic activity of subsystems utilizing the ethereum blockchain network. J. Risk Financ. Manag., 17. · DOI
  55. Guggenberger, 2022, An in-depth investigation of the performance characteristics of Hyperledger Fabric, Comput. Ind. Eng., 173, 108716, 10.1016/j.cie.2022.108716 · DOI
  56. Krishnamachari, 2020, A survey of blockchain-based strategies for healthcare, ACm Comput. Surv. (CsUr), 53, 1
  57. Baboi, 2023, Security of consensus mechanisms in blockchain, Rom. Cyber Secur. J., 5, 45, 10.54851/v5i2y202305 · DOI
  58. Haritha, 2023, Multi-level security in healthcare by integrating lattice-based access control and blockchain-based smart contracts system, IEEE Access, 11, 114322, 10.1109/ACCESS.2023.3324740 · DOI
  59. Odeh, A., Abdelfattah, E., and Salameh, W. (2024). Privacy-preserving data sharing in telehealth services. Appl. Sci., 14. · DOI
  60. Duda, 2022, HL7 FHIR-based tools and initiatives to support clinical research: A scoping review, J. Am. Med. Inform. Assoc., 29, 1642, 10.1093/jamia/ocac105 · DOI
  61. Eren, 2018, Analysing opportunities and challenges of integrated blockchain technologies in healthcare, Eurosymp. Syst. Anal. Des., 333, 174

Cited by

Sorted by citations

Metadata

Authors
Barbaria, S., Jemai, A., Ceylan, H. İ., Muntean, R. I., Dergaa, I., & Boussi Rahmouni, H.
Affiliations
  • Tunis University (TN)
  • University of Carthage (TN)
  • Physical Education and Sports Teaching Department, Faculty of Sports Sciences, Ataturk University, 25240 Erzurum, Türkiye
  • 1 Decembrie 1918 University (RO)
  • Manouba University (TN)
  • Laboratory of Biophysics and Medical Technologies, LR13ES07 (BTM), Higher Institute of Medical Technologies of Tunis (ISTMT), University of Tunis El Manar, Tunis 1080, Tunisia
Corresponding author
Muntean, Raul Ioan
ORCID
Venue
Healthcare
Publisher
MDPI AG
Published
2025-10-15
Volume
13
Issue
20
Pages
2594
ISSN
2227-9032 (ISSN-L)
DOI
10.3390/healthcare13202594
PMC
PMC12563691
OpenAlex
W4415241788
Cited by
53
References
10
Citations by year
2026: 47 · 2025: 6
FWCI
5.06
Type
journal article
Language
en
Open access
Licence
Locations
  • Healthcare (publishedVersion, cc-by)
  • Europe PMC (PubMed Central) (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • Ataturk University - AVESIS (submittedVersion)
Topics
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
  • Health Sciences › Health Professions › Health Information Management › Electronic Health Records Systems
  • Health Sciences › Health Professions › Health Information Management › Thoreau and American Literature
Keywords
blockchain, HIPAA, GDPR, health data interoperability, clinical research data sharing, Hyperledger Fabric, IPFS, HL7 FHIR, smart contracts, regulatory compliance automation, patient consent management, attribute-based access control, audit trail, privacy policy enforcement, permissioned blockchain, decentralized data management, scalability

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review