A Decentralized and Cryptographically Secured Platform for Inter-Hospital and Clinic Medical Record Sharing

What it does: A decentralized, cryptographically secured platform for sharing medical records between hospitals and clinics. Healthcare institutions upload and manage records (X-rays, prescriptions, lab results, diagnostic reports) through a web app, while patients use a companion mobile app to approve or reject data-sharing requests and securely share their own records with trusted people or groups. Patients can't upload data themselves — that responsibility stays with institutions to keep records consistent and reliable, but patients retain full authority over who gets access.

How I built it: I served as system architect, designing a hybrid cryptographic framework combining AES-256 for file encryption and RSA for secure key distribution among authorized parties. Encrypted files are stored on IPFS for decentralized, tamper-resistant storage, with SHA-256 hashing to verify file integrity. Every file event and integrity check is logged immutably on the Hive blockchain — including custom JSON creation, transaction signing (ECDSA/secp256k1), and broadcasting — so the audit trail can't be altered even if the app database is compromised. Supabase and Firebase handle authentication, metadata, and access control. Testing included NIST test vectors for the cryptography, OWASP ZAP and WebHint for security scanning, and user acceptance testing with a 100% task completion rate and zero critical vulnerabilities found.

What I learned: The biggest lesson was that blockchain works best as a complement to a traditional database, not a replacement for one — using it purely for tamper-proof hashes and metadata (never the actual medical content) gave us verifiable integrity without exposing sensitive data or bloating the chain. I also learned to design around a real regulatory constraint (the Philippine Data Privacy Act of 2012) from day one rather than bolting it on later, and to treat IPFS's immutability as a design decision, not a bug — using crypto-erasure (deleting the decryption keys) instead of trying to delete files. It also taught me how to reason about system architecture end-to-end: balancing security, performance (like RSA key-generation latency), and usability for non-technical hospital staff.