Privacy Challenges in Blockchain-Enabled Healthcare Information Systems: A Systematic Review and Lifecycle-Contextual Privacy Alignment Framework

Abstract

Blockchain-enabled healthcare information systems are increasingly proposed to improve trust, auditability, integrity, and decentralised access control in health-data sharing, but privacy concerns remain. This study aimed to identify where privacy challenges arise, what forms they take, why they persist, and what level of evidence supports them. A PRISMA 2020-informed systematic literature review was conducted across three databases, resulting in 42 included studies published between 2020 and 2025. The studies were synthesised according to privacy challenge location, challenge type, root cause, and evidence maturity. The findings show that privacy challenges are most frequently located in hybrid and cross-layer architectures, where blockchain interacts with off-chain storage, IoMT devices, identity mechanisms, access-control processes, and cross-organisational data sharing. Unauthorised access, off-chain storage exposure, metadata leakage, consent limitations, and identity linkability were the most frequently reported challenge types. Technical causes were coded in all 42 studies, a count shaped by the review’s technical inclusion criteria, with cross-layer and organisational causes also frequent. Counts describe the retrieved literature and are not prevalence estimates. Under a stricter five-level evidence hierarchy, 34 studies relied on formal, proof-of-concept, or laboratory evidence, five on conceptual analysis, and three were insufficiently reported; none reported operational deployment in a healthcare setting. Privacy outcomes in routine healthcare use therefore remain untested. The proposed Lifecycle-Contextual Privacy Alignment Framework links these findings to explicit technical, governance, stakeholder, and evidence criteria, a scoped decision rule, a mapping to the 1 + 5 architectural views, and three testable propositions. The framework is presented as a literature-derived conceptual proposal with a stated validation protocol, not as a validated instrument.