CareChain: Blockchain-Powered Secure Medical System

A doctor creates a medical contract that connects a patient to a proposed treatment type and description. The assigned patient can then review the same contract and approve it through a dedicated personal area.

This turns treatment consent into a visible lifecycle: creation, review, approval, and later verification. Each party sees the information relevant to their role instead of sharing one unrestricted administrative screen.

The React interface sends an authenticated request to the Node.js and Express API. After checking the active user and role, the backend submits the medical contract to Ethereum and waits for transaction confirmation.

The contract begins as pending. When the assigned patient approves it, the system records the new approval state on the blockchain and exposes the updated status to both sides.

CareChain keeps the readable medical agreement in encrypted, access-controlled storage. The smart contract manages the agreement's verification record, including a stable identifier, integrity Hash, opaque reference, timestamps, and approval state.

The backend handles blockchain communication through a managed signer, so doctors and patients use a familiar web product without managing MetaMask or paying gas directly. Creation and approval update the verifiable agreement state on the blockchain.

JWT authentication establishes the active identity, role checks control which contract actions are available, and object-level authorization verifies that the requested agreement belongs to the current doctor or patient.

Password hashing, TLS, digital certificates, input validation, and server-side permission checks reinforce the workflow. A patient cannot browse another patient's contracts simply by changing an identifier in the request.

Blockchain provides the agreement with a durable verification trail, while confidential medical content remains encrypted outside the public chain. Comparing the stored document with its on-chain Hash reveals whether the signed agreement has changed.

Managed encryption keys, contract-level authorization, immutable audit logs, security reviews, monitoring, and recovery procedures protect the full lifecycle around that verification record.