Blockchain for genomics and healthcare: a literature review, current status, classification and open issues

Nebula genomics.

Nebula Genomics is an Ethereum-based genomic data sharing and analysis platform; and it does not have a token yet. They aimed to overcome four fundamental problems, i.e., reducing sequencing costs, data protection, data acquisition, and big genomic data. Nebula network also aims to absorb the forthcoming data explosion (Grishin et al., 2018). In the traditional model, individuals share their data with an intermediary company. When a person wants to sequence his/her genetic material, he/she should contact a company that conducts the genetic analysis. After analyzing the genomic data, companies send only analysis results instead of the whole sequencing data, and they might sell genomic information to other companies since individuals cannot take control of their data access permissions. However, in the Nebula network with blockchain, individuals can share their data directly with their own terms, and gain a profit as shown in Fig. 3A. To use this network, people need to have their sequence analysis, which can also be provided by Nebula’s sequencing facility. It is claimed that a person can sequence his/her data at lower prices in this facility. Veritas Genetics is a partner of Nebula and thus, individuals mail their sample to Veritas Genetics to get the sequences on Nebula Servers. Whole sequencing data are given to the person, and it is erased from Nebula Servers. Although it is claimed that the data is deleted, full data privacy could not be ensured. The network consists of data owner nodes, data buyer nodes, secure-compute nodes, and Nebula servers.

The working principle of the Nebula system depends on the secure multi-party computation (Choi & Butler, 2019). In the network, data buyer nodes order genomic and phenotypic data with Nebula tokens and analyze the data only on a secure compute node because shared data must be encrypted with the HME format. Secure compute nodes run the bioinformatics platform called Arvados which supports Intel SGX and partially homomorphic encryption (Sadat et al., 2018). Intel SGX is a set of instruction codes and it allows the creation of private memory regions, which are called enclaves (Drucker & Gueron, 2017). Encrypted data is transferred to a secure computing node by the data owner. In the SGX enclave, the data is decrypted, further computations are performed, results are encrypted in the SGX enclave, and forwarded to a buyer node. Thus, buyers are able to get the results without seeing the data itself that partially solves the privacy problem.

Zenome.

Zenome, a ZNA token, is an Ethereum-based genomic ecosystem that focuses on genetic data sharing. With Zenome, data owners can share their own data, edit data access permissions, store data safely, earn money, propose recommendations for participants, perform genetic analysis and use other genetic services (Kulemin, Popov & Gorbachev, 2017). In the system, metadata is stored on a distributed network anonymously. Thanks to the data encryption, accessing to a participant’s genetic information is impossible unless the user lets others reach the original data. The system has four types of nodes, i.e., (i) Calculation and storage nodes provide storage and CPU power to get the rewards; (ii) People nodes provide genetic data and user services; (iii) Analyst nodes analyze genetic information; (iv) Service providers present a genetic service in return for payment on the platform. Players of the genetic services are scientific corporations, bioinformatics companies, medical centers, and laboratories. The Zenome is also suitable for other organisms and provides reports to the users if needed. The system uses artificial intelligence (AI) methods and all users need to use the Zenome software tool. Zenome software tool allows the users to arrange their own data privacy, such as full privacy, standard privacy, or public access options. The system can detect fake data during raw data preprocessing. Initially, the system looks for coverage according to a threshold and stores them based on fragments to deal with fake organisms. Thus, only a small amount of data is transferred through the blockchain. The rest of the data could be transferred through an encrypted communication channel.

Genecoin.

Genecoin, GEN token, is a bio-economy currency that provides sharing of genomic data securely based on the Ethereum blockchain (Schorchit et al., 2018). If one of the users can recruit another user to the global Genecoin network, the system will send incentives, up to one thousand Genecoin, without a cost. It samples an individual’s DNA and stores it in the blockchain network. The genetic material of people is spread to thousands of computers in the networks. The company sends a kit to collect a sample from the individual and then communicates with the third-party service providers to obtain the sequencing data. The system provides software, which can extract and decrypt the genome of users from the blockchain. Founders hold %10 of the tokens, and %15 of the tokens are distributed among supporters.

Gene-chain.

Gene-chain is a Hyperledger-based blockchain application that focuses on a safe, traceable, and unhackable method for transactions, consisting of genomic data (Encrypgen, 2017). It does not have a token yet. In the system, when data is uploaded, the access permissions are organized entirely by the owner. Each user has a copy of the most recent ledger; hence, the database of the platform is shared and decentralized. Also, data sharing is performed like peer-to-peer, so there is no intermediary. The data identity is pseudo-anonymous since they use public and private keys. Re-identity of them is possible, even though unlikely (Malin & Sweeney, 2004). Patients can upload data freely, but they may upload fake data. To solve this problem, the system claims that it has an ability to remove unauthorized data.

DNATIX.

DNATIX, DNAtix token, is an Ethereum-based project to provide a transparent, accessible, and secure platform for data sharing to consumers, researchers, laboratories, and clinics. It allows users to upload users’ genetic data anonymously and it performs a genetic test on these data according to the access permission conditions set by the users. In addition to other systems, one of the key improvements in this system is as follows. The participants can earn tokens via developing a new application on Next Generation Decentralized Genetic Application (GDAPPS) which has its own virtual machine like DNAtixVM and it can be run as a node. Another advantage of DNATIX is its own compressing algorithm for compressing long DNA sequences. The current algorithm of it can compress %25 of the sequence’s size. Similar to other projects, the platform uses smart contracts to store, transfer, and genomic test data. Also, the platform can revoke and update access. In order to determine the transaction fee (gas), they found a suitable number of nucleotides (DNATIX, 2018).

Medrec.

The first implementation of MedRec is announced in 2016 (Azaria et al., 2016). The current version of Medrec, MedRec 2.0, does not have a token yet and it is still under development by MIT Media Lab with GO-Ethereum and Solidity. Medrec is a blockchain-enabled Electronic Health Record sharing platform; it works safely, transparently between patients and providers; and it is scaleable. The Medrec system provides to patients transparency, quick access, and the correction of errors by the authority for the patients’ records. The system is built on smart contracts. The records are not stored directly by the Medrec; only the metadata of the information is stored. To provide system security and patient privacy, the blockchain is maintained by the providers and a selected group performs the consensus. In the system, there are 3 types of contracts; registrar contract, patient-provider relationship contract, and the summary contract. Registrar contract includes participant IDs for their Ethereum identity. Patients can update their information and this operation is added to the registrar contract only if it is confirmed by the patient. Patient-provider relationship contract connects patient node and provider node and contains their relationship. Finally, summary-contract consists of different relationships of the participants in the system. It includes a reference list to the patient-provider relationship contracts. Each relationship has a status value, which shows when the relationships were established and what the permissions are (Lipman et al., 2017). When a service provider wants to update a health record of a patient, it creates a request with the patient’s ID, as shown in Fig. 3. (b). The request is processed on the blockchain network, and the contract is examined. If the Medrec system gets all confirmations, an update is carried out successfully and the patient is informed about this update. When a patient requests access to his/her health records, the request is sent to the Database Gatekeeper of the provider. The Database Gatekeeper provides a tool for accessing the participants’ local databases. Then, the request is processed on the blockchain and the summary contracts and the patient-provider contracts are examined by the system. If the system verifies the contract, EHR is shared with the patient. For privacy, Medrec uses a system of delegated contracts where each provider creates a different Ethereum identity for each new patient-provider relationship. In terms of scalability, the platform does not have an exact solution since scalability is one of the critical challenges for any blockchain system.

IRYO.

It, the IRYO token, is the EOS-based health record sharing and storage platform (IRYO, 2017). It allows the preparation of permission controls and performs AI-based research. Several AI methods require to access patient data in order to formulate and test a new algorithm for early-stage detection of diseases and developing new treatments. These systems can be based on OpenEHR (Atalag et al., 2013) data modeling and sharing. Although the OpenEHR community continues to collect data for 15 years, they cannot exchange the data globally and they cannot collect data from more extensive areas. The IRYO is the global storage of EHR and it aims to share the archetypes data such as blood pressure with mobile devices for predicting a condition. Instead of holding the data in one place, the users encrypt their data on their mobile devices with a public key and hence the attacks are prevented. The private key decryption is performed on the devices of the patients. When someone wants to access patient data, this request must be approved by the patient who is using the IryoEHR application. Then, the doctors can obtain a re-encryption key to access the data. Encrypted health records are stored on three types of nodes. The first copy is kept on the IRYO cloud node, the second copy is stored on the home clinic storage node, and the last one is stored on the end-user device nodes.

Figure S1 shows the architecture of the IRYO nodes. To keep the data storage system secure from possible risks, IRYO keeps at least one encrypted alive copy. In this way, it can guarantee protection for any kind of health data. To use the stored data in AI methods, first, the research institution must be verified by IRYO. Researchers should use the IRYO research software tool to make a new request. If the submitted query of a researcher matches a patient’s criteria, the patient gets a notification on his phone. As soon as the patient accepts the process, the data is shared with the research institution, and the patient earns some tokens. Once the researcher’s analysis is finished, the patient gets a notification on his phone related to the analysis results. In the system, researchers can study both anonymous and pseudo-anonymous personal data. The IRYO network is a public blockchain. All storage nodes supply cryptographic proofs to patients using writing hashes in the EOS blockchain (Grigg, 2017).

Coral health.

Coral Health, CHT token, is an Ethereum-based data sharing platform for EHR and genetic test results for personalized medicine (Abul-Husn & Kenny, 2019). With the usage of a precision medicine program, more successful results with lesser side effects could be obtained in treatment. Coral Health aims to create an interoperable, accessible, secure, and scalable healthcare ecosystem for fixing the issues in genetic data collection and data sharing (Park et al., 2017). In the system, patients can share their medical records directly with providers, laboratories, and others. During this process, they take control of their data access permissions using their accounts. Like Apple Health, the Coral Health system uses SMART and Fast Healthcare Interoperability Resource (FHIR: http://hl7.org/fhir/) protocols for establishing a connection between each mobile device of patients and other environments that host their medical data.

When a laboratory result or prescription is obtained for a patient, the notification comes to the patient’s mobile device. If a patient verifies the notification, pharma companies or others can buy the sample results. Information on patients is stored in an encrypted format on the mobile devices in a Health Information Trust Alliance (HITRUST) and the Health Insurance Portability and Accountability Act (HIPAA: https://www.hhs.gov/hipaa/index.html) compliant manner (Bosworth, Kabay & Whyne, 2014). Only the patient has a key for sharing the data. Besides, if one person arrives in an emergency room and if the patient is unconscious, the doctors can access the patient’s medical records fastly. Using the genetic information of this person and other biomarkers, the doctors can apply a personalized treatment. The system supports different data types such as images from radiology, genetic test results, or microbiology test results.

Patientory.

The Patientory, PTOY token, is an Etheruem-based electronic health record data-sharing platform. In the classical system, a patient can receive his/her medical history and can share it with doctors; or a doctor can follow the health status of the patient with a mobile healthcare application. However, in this classical system, those processes take time and doctors can only access limited data. Also, there is a centrality problem in classical systems, which means that classical systems are not completely secure. In the proposed system, users can access their medical records easily, and also they can update the data or share it with other scientists or doctors. When the system is developed, primary attention was paid to the Health Insurance Portability and Accountability Act law. The patient-related application is free, and 10 MB storage capacity is provided to the participants. After 10 MB of data storage, users are required to pay a certain amount of PTOY. Patients can create individual profiles via their mobile applications. They store the patients’ information on a secure, HIPAA-compliant blockchain platform. At the same time, they communicate with other users who have a similar health problem. As in all other projects, it uses a smart contract for data access permissions of users that can be easily edited. The system is international, so it is not limited to use in the USA (Mcfarlane et al., 2017).

Medicalchain.

Medicalchain, MTN token, is an Ethereum and Hyperledger based EHR sharing project that empowers secure, quick and transparent transactions and enables the utilization of medical information. It is built by employing a dual blockchain structure. The first blockchain controls the access to health records and it is built by using Hyperledger Fabric. The second blockchain, Ethereum, is fueled by underlies all the applications and services for the platform. The Hyperledger is a permission-based network, which means that someone needs to sign up to join this network. For specific applications which require keeping the data confidentially, or which only allow particular people to access the data, Hyperledger Fabric is used. Hyperledger Fabric accommodates numerous layers of permission, which means that there are several methods to adjust access control. Hence, Hyperledger Fabric could be a better solution for inspecting the access to health records.

One of the advantages of using a smart contract in the healthcare system can be exemplified as follows. Doctors spend so much time on billing and insurance-related actions. If these processes were achieved with smart contracts, and if these processes were validated by Ethereum, significant savings in terms of cost could be achieved. In order to prevent the attempts of stealing the identities, the system is partnered with Civic (CIVIC Technologies, 2017). The system uses Civic’s authentication services, where the Civic securely manages identities using a decentralized network. They use the biometrics of users for the verification of identities. Participants consist of practitioners, patients, and research institutions. Symmetric key encryption is used to supply privacy and to encrypt health records (Agrawal & Mishra, 2012; Kumar, Munjal & Sharma, 2011). The Medicalchain also has a backup access system for emergency conditions. It uses a bracelet that the patients wear. To unlock and reach the information, two doctors would need to scan the bracelet. In this way, the doctors can easily reach the patient’s medical records and hence, the best treatment can be provided (Medicalchain, 2018).

GemOS.

The GemOS, which does not have a token yet, is Ethereum and Hyperledger based EHR sharing platform. GemOS is developed to support patient-centric healthcare and personalized medicine with the partnership of Philips. Siloed databases mainly consist of electronic health records. Different companies or organizations manage each one and people has to spend money on reconciliation. The project aims to isolate sensitive data, create scalability, flexibility, and present an extensible platform to solve fundamental issues like reconciliation and others. It provides an explicit mechanism based on four essential components; data, identity, network, and logic. Although detailed technical explanations are not available for this project, to get an idea of this project’s overall structure, interested readers can refer to their white papers (Kannan & Smith, 2016).

e-Estonia.

The e-Estonia is a Keyless Signature Infrastructure (KSI: https://www.guardtime-federal.com/ksi/) blockchain-based project that adapts the registration of many state institutions like the electronic healthcare system, in cooperation with Guardtime. Figure S2 illustrates the KSI technology of Guardtime. Keyless Signature Infrastructure (KSI) has been developed in Estonia. While preserving data privacy, it is used internationally to ensure that networks, processes and data are free of compromise (KSI Blockchain Website). Unlike traditional digital signature approaches, KSI uses only hash-function cryptography. In KSI, verification only relies on the security of hash functions and the availability of a public ledger. This is commonly referred to as a blockchain. KSI blockchain claims that it can get over scalability and settlement time problems of traditional approaches. Conventional approaches to blockchain expand linearly with the number of transactions. On the other hand, the KSI blockchain grows linearly over time and it is irrespective of the number of transactions. The distributed consensus protocol of the KSI blockchain is limited. By limiting the number of participants, consensus can be achieved synchronously, removing the need for PoW and ensuring that settlement will occur within a second. KSI Blockchain is also using hash trees to keep the data. All transactions within a time frame are collectively saved as a hash tree to support the high number of signatures. The critical values at the top of the trees are connected to each other to create a general hash tree.

The system has two main applications. The first one is electronic patient records and the second one is electronic prescription. Electronic patient registration system combines different types of health information from the institution. The blockchain controls safety of patient records and access to the log of data. Also, patients can access their own records using the given authorization for access. The system supports the usage of mobile devices (e Estonia, 2012). All prescriptions have been completed in the digital environment. With e-prescription, only using the ID-card number of a patient is enough to reach the original prescription. Besides, it is not needed to continuously visit the doctor if a patient is using a particular medicine for a long time. Through the system, the patient notifies the doctor with a request; then, the doctor uploads a new e-prescription to the system (Buldas A. Kroonma A. Laanoja, 2013).