Blockchain-Based Dynamic and Revocable Consent for Secondary Health Data Use: Systematic Review

Clinical Snapshot

Key Findings

• Effect Size: Not applicable — narrative systematic review; no quantitative effect sizes reported. Qualitative synthesis indicates 'most' included frameworks employed smart contracts and DIDs, but precise proportions are not reported in available data

• Primary Outcome: Blockchain-based frameworks — predominantly using smart contracts, decentralised identifiers (DIDs), and verifiable credentials — demonstrate technical feasibility for automating consent life cycles, ensuring immutable audit trails, and enabling decentralised patient control over secondary health data use

• Nnt Or Sensitivity: Not applicable — no clinical outcome metrics, diagnostic accuracy statistics, or comparative effectiveness data reported. Key performance limitations identified include real-time revocation propagation delays, interoperability gaps with EHR/clinical systems, and unresolved GDPR right-to-erasure conflicts

• Confidence Interval: Not applicable — no meta-analytic pooling performed

Clinical Application

Clinical implementation remains largely aspirational at this stage. The review identifies substantial barriers: limited real-world deployment evidence, unresolved interoperability with existing clinical information systems (EHRs, FHIR-based platforms), technical complexity of real-time consent revocation propagation, and regulatory uncertainty regarding GDPR right-to-erasure compliance in immutable ledger architectures. Human-centred design and usability testing are identified as critically underdeveloped. Transition from proof-of-concept to production-grade health system integration requires significant infrastructure investment and regulatory clarification. Australia presents a relevant and complex implementation context. The My Health Record system (operated under the My Health Records Act 2012) already incorporates patient-controlled access mechanisms, but consent management for secondary data use — particularly for research via the Australian Institute of Health and Welfare (AIHW) and state-based data linkage units — remains governed by static, paper-based, or siloed digital consent processes. The Office of the Australian Information Commissioner (OAIC) and the Privacy Act 1988 (including the Australian Privacy Principles) impose obligations analogous to GDPR, including data minimisation and purpose limitation, though Australia lacks an equivalent right to erasure — a tension the review identifies as central to blockchain consent architectures. The TGA does not currently regulate blockchain consent platforms as medical devices, though AI-integrated decision support tools built upon such infrastructure may attract regulatory scrutiny. RACGP standards for patient privacy and the National Health and Medical Research Council (NHMRC) National Statement on Ethical Conduct in Human Research would both be implicated in any real-world deployment. The Australian Government's National Digital Health Strategy 2023–2028 and ADHA's work on interoperability provide a policy framework within which blockchain consent solutions could be piloted, particularly for genomic data reuse and population health research cohorts. Healthcare organisations, health data custodians, digital health platform developers, and policy makers involved in secondary use of patient health data for research, population health analytics, or AI-driven clinical decision support. Patients whose data may be used beyond primary care encounters are the ultimate beneficiaries of improved consent infrastructure.

Abstract

BACKGROUND: The secondary use of health data holds substantial potential for advancing biomedical research, strengthening population health analytics, and enabling artificial intelligence-driven decision-making support. Yet, ensuring that such reuse respects patient autonomy, privacy, and regulatory obligations remains a major challenge. Conventional consent mechanisms are typically static, difficult to revoke, and offer limited transparency or accountability after data disclosure. OBJECTIVE: This review aimed to systematically examine blockchain-based frameworks that enable dynamic, auditable, and revocable consent for the secondary use of health data. METHODS: A structured literature search was conducted in PubMed, Scopus, and Web of Science covering the period 2020 to 2025. Following PRISMA (Preferred Reporting Items for Systematic Reviews and Meta-Analyses) guidelines, 55 peer-reviewed studies meeting predefined inclusion criteria were analyzed. Data extraction focused on four dimensions: (1) consent life cycle management, (2) auditability and traceability, (3) usability and patient empowerment, and (4) legal and ethical alignment. RESULTS: Findings indicate that blockchain technologies provide a robust foundation for automating consent life cycles, ensuring immutable auditability, and enabling decentralized patient control. Most frameworks used smart contracts, decentralized identifiers, and verifiable credentials to implement programmable and verifiable consent processes. Nevertheless, key challenges persist, including limited usability testing, complexities in real-time revocation propagation, interoperability gaps with clinical systems, and tensions with regulatory requirements such as the General Data Protection Regulation right to erasure. Only a small subset of studies reported real-world deployments or user-centered evaluations. CONCLUSIONS: Blockchain offers substantial promise for improving the trustworthiness, transparency, and accountability of consent management for secondary health data use. However, wider adoption requires human-centered design approaches, stronger interoperability through standards such as Fast Healthcare Interoperability Resources, verifiable credentials, and consent receipts, and clearer legal guidance for compliance. Future research should prioritize integrating blockchain-enabled consent infrastructures into national and cross-border digital health ecosystems such as the European Health Data Space to support secure, patient-controlled, and ethically governed secondary data use.

References

1. 1.Phuyal, S., Bhandari, M., Bista, R., & Ferreira, J. C. (2026). Blockchain-based dynamic and revocable consent for secondary health data use: Systematic review. JMIR Medical Informatics. https://doi.org/10.2196/88536