Paper-based folders have been widely used to coordinate cares in medical-social networks, but they introduce some burning issues (e.g. privacy protection, remote access to the folder). Replacing the paper-based folder system by a traditional Electronic Healthcare Record (EHR) introduces new drawbacks: forcing of the patient consent, unbounded data retention, no security guarantee outside the server domain and no disconnected access to the folder. To solve these problems, this paper proposes an experimental platform which combines an EHR system with medical-social folders embedded in a new hardware portable device. The objectives pursued are (1) to re-establish a natural and powerful way of protecting and sharing highly sensitive information among trusted parties and (2) to build a shared medical-social folder providing the highest degree of availability, whatever the mode of operation (disconnected or not).

Imagine that you have been entrusted with private data, such as corporate product information, sensitive government information, or symptom and treatment information about hospital patients. You may want to issue queries whose result will combine private and public data, but private data must not be revealed. GhostDB is an architecture and system to achieve this. You carry private data in a smart USB key (a large Flash persistent store combined with a tamper and snoop-resistant CPU and small RAM). When the key is plugged in, you can issue queries that link private and public data and be sure that the only information revealed to a potential spy is which queries you pose. Queries linking public and private data entail novel distributed processing techniques on extremely unequal devices (standard computer and smart USB key). This paper presents the basic framework to make this all work intuitively and efficiently.