Blockchain in Healthcare: Promise vs Practice

Every few years, someone promises that blockchain will give patients a single, secure, lifelong health record. Years later, most patients still request records by portal, fax or form, and the biggest interoperability gains have come from ordinary data standards and national exchange networks.

That doesn’t mean blockchain has no place in healthcare. It has found narrower, more practical jobs: tracing drug packages, sharing provider data across health plans and proving that records haven’t been altered. The gap between promise and practice comes down to one question: what problem needs a shared, tamper-evident ledger that a regular database can’t solve?

This guide looks at the 3 most-discussed uses, records, credentialing and drug tracking, and tests each against privacy rules. This is general information, not legal or medical advice.

What blockchain can and can’t do for health data

A blockchain is a shared ledger copied across several computers, where new entries are linked to earlier ones so changes are easy to detect. In healthcare, that offers 3 real strengths:

• A shared source of truth between organizations that don’t fully trust each other, such as rival health plans or drug manufacturers and distributors
• Tamper evidence, meaning anyone can check whether an entry was altered
• An audit trail of who added or accessed what, and when

It also has real weaknesses for health data:

• Copies everywhere. Every participant typically holds a copy of the ledger. Putting protected health information on it means sharing that information with every node.
• Hard to change. Records are designed not to be edited, while health data needs corrections and sometimes deletion.
• Garbage in, garbage out. A ledger proves an entry hasn’t changed. It can’t prove the entry was correct.
• Governance. Someone still has to decide who joins, who pays and which data standards apply.

Use 1: Patient medical records

This is the most hyped idea and the least proven. The pitch is a patient-controlled record that every provider can read.

Why records rarely go on-chain

Most designs that survive privacy review store no health data on the blockchain at all. Instead, the record stays in the provider’s electronic health record system, and the ledger holds only:

• A hash, a digital fingerprint that proves the record hasn’t changed
• Pointers to where the data lives
• Consent and access permissions, such as which provider may view which record

Estonia offers an example of this pattern. In 2016, its eHealth authority announced a partnership with Guardtime to use the company’s KSI blockchain technology to protect the integrity of health records by recording signatures of the data, not the records themselves.

How HIPAA shapes the design

The HIPAA Privacy and Security Rules apply to covered entities, such as providers and health plans, and their business associates. A few rules matter most for blockchain:

• Sharing is disclosure. Writing protected health information to a ledger that other organizations can read is a disclosure that needs a permitted purpose, and vendors handling it typically need business associate agreements.
• Security safeguards still apply. Encryption, access controls and audit logs remain required regardless of the technology. See our guide to HIPAA compliance for software.
• Patients can request amendments. Under 45 CFR 164.526, when a covered entity accepts an amendment it must identify affected records and append or link to the amendment. HHS has said HIPAA doesn’t require expunging the original information, so an append-only design isn’t automatically a violation. But other laws, including some state privacy laws and the EU’s GDPR for EU data, can require deletion, which on-chain data makes very difficult.

The practical answer is to keep health data off-chain, where it can be corrected, secured and deleted under normal rules. This is not legal advice.

What’s actually improving record sharing

Most progress in US record exchange is coming from standards and networks, not ledgers. HL7 FHIR APIs let apps pull records, and TEFCA, the national framework for health information exchange that went live in December 2023, now connects tens of thousands of organizations through designated networks. If your goal is better record sharing, those are the tools to plan around.

Key takeaway: Keep patient data off the blockchain. If a ledger helps at all, it’s as a tamper-evident log of hashes, consents and access events that sits beside your existing systems.

Use 2: Provider credentialing and directories

Every health plan and hospital has to verify each clinician’s licenses, education, board certifications and practice details. Many organizations repeat the same checks, and provider directories are notoriously out of date.

This is a more natural fit for a shared ledger because:

• The data is mostly professional, not patient health information
• Many organizations need the same verified facts
• No single party wants a competitor to own the shared database

The best-known example is the Synaptic Health Alliance, formed in 2018 by companies including Humana, MultiPlan, Optum, Quest Diagnostics and UnitedHealthcare to pilot a permissioned blockchain for sharing and validating provider directory data. Aetna and Ascension joined later that year.

Still, existing shared databases already handle much of this job, such as the CAQH ProView platform many plans use for provider-supplied credentialing data. The question for any credentialing project is whether a ledger adds enough over a well-governed central service to justify the extra complexity.

Use 3: Drug supply chain tracking

Drug tracing is where blockchain has been tested most seriously, because a federal law demands it.

The Drug Supply Chain Security Act (DSCSA), enacted on November 27, 2013, required an interoperable, electronic system to trace prescription drugs at the package level starting 10 years after enactment. Manufacturers, wholesalers, repackagers and dispensers must exchange transaction information and verify products.

In FDA’s 2019 DSCSA pilot project program, several teams tested blockchain, including the MediLedger project and a group made up of IBM, KPMG, Merck and Walmart. Their reports concluded a blockchain network could support package-level tracing, while stressing that industry governance and interoperability would decide success.

In practice, FDA’s September 2023 standards guidance recommends that trading partners use the GS1 EPCIS standard to share transaction data. EPCIS is a data standard, not a technology choice, so trading partners can exchange it through conventional systems or a blockchain network. The law itself doesn’t require a shared ledger. FDA has also granted phased exemptions, and small dispensers, generally those with 25 or fewer full-time pharmacists and pharmacy technicians, are exempt from certain requirements until November 27, 2027. For the wider picture, see our guide to blockchain in supply chains.

Promise vs practice at a glance

The real costs and risks

Before funding a project, plan for these:

• Consortium building. A shared ledger is only useful if competitors join and agree on rules, data formats and costs.
• Integration. You still need to connect EHRs, pharmacy systems and claims platforms.
• Security. Ledgers don’t stop phishing, ransomware or stolen credentials. If you’re responding to an incident, see what to do after a health data breach. A zero trust security approach still matters more than the database type.
• Regulatory review. Legal teams must sign off on data flows, business associate agreements and retention.
• Exit plans. Many enterprise blockchain projects have been shut down. Make sure you can export your data if the network ends.

Where to start: a 5-step evaluation

If someone proposes blockchain for your health organization, work through these steps:

1. Name the problem. Is it trust between organizations, tamper evidence or something a better database would fix?
2. List the participants. If only your organization writes data, you don’t need a shared ledger. Our blockchain decision guide walks through the logic.
3. Map the data. Mark anything that’s protected health information and design so it stays off-chain.
4. Check standards. Use FHIR for clinical data, EPCIS for drug tracing and existing credentialing services where they fit.
5. Pilot narrowly. Start with 1 workflow, clear success measures and a governance agreement before you scale.

The bottom line

Blockchain in healthcare is useful in narrow places: drug traceability, shared provider data and tamper-evident audit logs. It’s a poor home for patient records, which need privacy, corrections and sometimes deletion. Most real progress in data sharing comes from standards like FHIR and EPCIS and from national exchange networks. Treat blockchain as one tool for multi-party trust, not as the answer to healthcare’s data problems. For more on where health technology is actually heading, see AI in healthcare in 2026.

Sources

• FDA: Title II of the Drug Quality and Security Act (DSCSA) — package-level electronic tracing requirements 10 years after enactment
• FDA: Exemptions under the Drug Supply Chain Security Act — small dispenser exemption until November 27, 2027 and eligibility
• FDA: DSCSA Standards for the Interoperable Exchange of Information for Tracing (guidance, September 2023) — recommendation to use the GS1 EPCIS standard
• FDA: DSCSA Pilot Project Program final report — 2019 industry pilots on traceability
• eCFR via Cornell LII: 45 CFR 164.526, Amendment of protected health information — HIPAA amendment process
• HHS: Nationwide health data exchange milestone (TEFCA) — TEFCA exchange operational in December 2023