Healthcare industries are subject to various laws and regulatory oversight, just like other industries, such as pharmaceuticals, telecommunications, education, and financial services. Compliance with these regulations is essential for the organization's operation and growth. To help organizations detect early non-compliance issues, this paper proposes a consensus mechanism, Proof of Compliance (PoC), where a set of distributed, decentralized, and independent auditor nodes perform audit operations to determine the compliance status of any logical operations or accesses that have already been approved, granted, or executed in the system. The Proof of Compliance consensus mechanism helps organizations minimize compliance challenges. Organizations can consider PoC outputs to take further actions to reduce non-compliance cases and avoid compliance issues and business losses. The PoC reports do not support final regulatory compliance certification. However, it is possible if one or more multiple audit nodes are deployed and maintained in the consensus mechanism by the corresponding regulatory, government, or compliance authority.

Body area networks (BANs) frequently generate sensitive healthcare data from sensors and other devices. Security and privacy breaches in BAN systems can compromise information affecting patients’ physical health, emotional state, and financial well-being. The lack of well-defined security perimeters and qualified personnel to administer security in such dynamic environments requires an authorization framework for protecting patient data, where access depends on the users’ credentials, location, and time. Toward this end, this work aims to define a secure system architecture to incorporate fine-grained information access management. It also leverages a spatiotemporal attribute-based access control (STABAC) model to make it possible to enforce location and time factors with BAN policies and required attributes to make access decisions. The BAN policies have various dynamic constraints that may conflict with each other or introduce inconsistencies. Therefore, this work proposes a formal verification framework using timed colored Petri nets to ensure such errors are not introduced. The blockchain network is utilized to maintain policy integrity, where STABAC verifies policy integrity from the network through smart contract services before making access decisions. Finally, the policy and attribute management framework ensures that STABAC maintains a verified set of policies and attributes for authorizing uninterrupted care and services.