Privacy Leakage in Blockchain-Based Healthcare Systems: A Layered Taxonomy and Systematic Review

Abstract

Blockchain technology has emerged as a compelling architecture for electronic health record (EHR) management, offering decentralization, immutability, and cryptographic auditability to address longstanding vulnerabilities in centralized healthcare data systems. Yet these same architectural properties introduce privacy leakage risks that existing surveys have not systematically examined: transparency enables transaction pattern analysis and patient reidentification; immutability conflicts with regulatory erasure obligations; and consensus operations expose institutional identities. This systematic review, following Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines and analyzing 47 peer-reviewed original articles published between 2023 and 2026, develops what is, to the best of our knowledge, one of the first layered taxonomies of privacy leakage risks in blockchain-based healthcare systems, organized across the data, network, consensus, and application layers. The taxonomy maps 15 distinct attack vectors to their architectural origins and available countermeasures. Findings reveal that advanced techniques, including attribute-based encryption (ABE) with policy hiding, post-quantum lattice-based signatures, zero-knowledge proofs, and federated learning (FL) with differential privacy, provide significant but incomplete protection; critical vulnerabilities persist in metadata handling, peer-to-peer communication patterns, and consensus operations. Four concrete research priorities are identified: privacy-aware consensus protocols, standardized reidentification risk metrics, lightweight post-quantum primitives for resource-constrained IoT medical devices, and regulatory-compliant data erasure mechanisms compatible with General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA).