  This paper addresses the critical challenge of ensuring healthcare policy
compliance in the context of Electronic Health Records (EHRs). Despite
stringent regulations like HIPAA, significant gaps in policy compliance often
remain undetected until a data breach occurs. To bridge this gap, we propose a
novel blockchain-powered, smart contract-based access control model. This model
is specifically designed to enforce patient-provider agreements (PPAs) and
other relevant policies, thereby ensuring both policy compliance and
provenance. Our approach integrates components of informed consent into PPAs,
employing blockchain smart contracts to automate and secure policy enforcement.
The authorization module utilizes these contracts to make informed access
decisions, recording all actions in a transparent, immutable blockchain ledger.
This system not only ensures that policies are rigorously applied but also
maintains a verifiable record of all actions taken, thus facilitating an easy
audit and proving compliance. We implement this model in a private Ethereum
blockchain setup, focusing on maintaining the integrity and lineage of policies
and ensuring that audit trails are accurately and securely recorded. The Proof
of Compliance (PoC) consensus mechanism enables decentralized, independent
auditor nodes to verify compliance status based on the audit trails recorded.
Experimental evaluation demonstrates the effectiveness of the proposed model in
a simulated healthcare environment. The results show that our approach not only
strengthens policy compliance and provenance but also enhances the transparency
and accountability of the entire process. In summary, this paper presents a
comprehensive, blockchain-based solution to a longstanding problem in
healthcare data management, offering a robust framework for ensuring policy
compliance and provenance through smart contracts and blockchain technology.
