sicherlich: a patient-held medical record

sicherlich is a research and development project for a medical record that the patient holds. Documents are stored encrypted on the patient's own device. Whoever needs part of the record (a practice, an insurer, the next doctor) receives it in an envelope of their own, for a period the patient sets and can end.

→ see also: Blockchain Approach to Medical Data Ownership, the first concept

starting point

Medical documents arise in many places: practices, hospitals, laboratories, insurers. Each keeps its own copy. The patient has a right to inspect and to receive copies, but does not hold the record.

Three provisions set the frame in Germany. § 630f BGB makes the practitioner the keeper of the patient record and requires it to be kept for ten years after the end of treatment. § 630g BGB gives the patient the right to inspect the record and to receive copies. Article 17(3)(b) GDPR suspends the right to erasure where a legal retention duty applies. Careful key management on the patient's side therefore does not change who holds the record.

approach

The project works from the patient's device outward.

• Vault. A local, encrypted store: keys derived with Argon2id, records encrypted with AES-256-GCM in a SQLite file.
• Intake (PhotoFlow). Scans pass through local OCR and a deterministic classifier; a model extracts the fields. The patient confirms each document before it is filed. An optional external extraction service is a deliberate boundary: if it is enabled, the page image leaves the device.
• Exchange. Each recipient receives an envelope of their own. Intermediaries carry ciphertext only; the relay deletes it after a fixed period and can be self-hosted. A ledger on the patient's device records who may see what, and until when.
• Rights. Letter templates for access, erasure and portability (Articles 15, 17 and 20 GDPR).

Insurers call a claim that runs from intake to payout without human involvement Dunkelverarbeitung, dark processing. PhotoFlow applies the same automation on the patient's side and ends in a confirmation step: nothing is filed without the patient's approval.

Envelope encryption is an established technique. The open questions of the exchange layer are legal.

limits of revocation

A grant can be ended: no new key is issued and the encrypted copy is withdrawn. This cannot undo that a recipient has already read a page. That limit is technical. The second limit is legal: a practice has to keep its record for ten years, so a patient's revocation cannot reach it.

design premise

The project assumes a different allocation: the patient holds the record, and the practice works on a copy that the patient grants for as long as the treatment requires. The retention period stays at ten years, because it protects patients: a record that can be shortened unnoticed cannot prove a treatment error. What changes is where the duty attaches, from the practice's filing cabinet to the record the patient holds.

A patient-held record has to be able to represent the limits of § 630g BGB, under which a practitioner may refuse inspection for significant therapeutic reasons or because of significant rights of third parties.

There are two routes: a change in the law, or a working mechanism that turns the legal question into one about something that exists. The project takes the second route, with legal advice before any real practice's data is involved. The legal points above are working hypotheses; assessing them is part of the project.

the transparent patient

Gläserner Patient, the transparent patient, is usually read as a warning against sharing data. The project reads it differently: transparency results from who holds the data and who decides where it goes, not from sharing as such. On transparency demands and the assumption of concealment behind them, see At Their Word.

work packages

1. Connect PhotoFlow and the vault without a manual transfer.
2. Exchange between two devices of one person, where no third party and therefore no legal question is involved.
3. Grant ledger with revocation: what "revoked" means once the encrypted copy has been delivered.
4. Legal review by a data protection lawyer; who may send and receive an envelope; a pilot with one practice.
5. Insurance: statutory contributions are income-based, private premiums risk-based. Which parts of a patient-held record an insurer may see under either model is unresolved.