We present a patient-centric architecture for electronic health record (EHR) sharing that separates content storage from authorization and audit. Encrypted FHIR resources are stored off-chain; a public blockchain records only cryptographic commitments and patient-signed, time-bounded permissions using EIP-712. Keys are distributed via public-key wrapping, enabling storage providers to remain honest-but-curious without risking confidentiality. We formalize security goals (confidentiality, integrity, cryptographically attributable authorization, and auditability of authorization events) and provide a Solidity reference implementation deployed as single-patient contracts. On-chain costs for permission grants average 78,000 gas (L1), and end-to-end access latency for 1 MB records is 0.7--1.4s (mean values for S3 and IPFS respectively), dominated by storage retrieval. Layer-2 deployment reduces gas usage by 10--13x, though data availability charges dominate actual costs. We discuss metadata privacy, key registry requirements, and regulatory considerations (HIPAA/GDPR), demonstrating a practical route to restoring patient control while preserving security properties required for sensitive clinical data.

翻译：我们提出了一种以患者为中心的电子健康记录共享架构，该架构将内容存储与授权及审计分离。加密的FHIR资源存储在链下；公共区块链仅记录密码学承诺以及使用EIP-712标准、由患者签名且具有时间限制的权限。密钥通过公钥封装进行分发，使得存储提供商能够保持诚实但好奇的状态，而不会危及数据机密性。我们形式化了安全目标（机密性、完整性、密码学可归因的授权以及授权事件的可审计性），并提供了一个部署为单患者合约的Solidity参考实现。授权授予的链上成本平均为78,000 gas（L1层），对于1 MB记录的端到端访问延迟为0.7–1.4秒（分别为S3和IPFS的平均值），主要受存储检索时间支配。Layer-2部署将gas使用量降低了10–13倍，尽管数据可用性费用在实际成本中占主导地位。我们讨论了元数据隐私、密钥注册要求以及监管考量（HIPAA/GDPR），展示了一条在保持敏感临床数据所需安全属性的同时，恢复患者控制权的实用路径。