Cryptographic Tokens as an Incentive Mechanism for Patient-Reported Outcome Measures Surveys

1. Introduction

The knowledge base which serves as the foundation for knowledge-based healthcare is constantly evolving. A central part to gain new knowledge that could be added to this knowledge base is to obtain outcome measures of given health services and treatments [1]. Although outcomes associated with the physical, physiological and biomedical conditions of a patient can be measured with objective tools and devices, some outcome data can only be obtained by asking the patient. This kind of collected data is referred to as patient-reported outcomes (PROs). PROs have been suggested to play a larger role in patient-centred healthcare in recent years for their ability to collect outcome data that previously been lacking [2]. We have in this work adapted U.S Food & Drug Administrations (FDA) definition of PROs: PRO is any report of the status of a patient’s health condition that comes directly from the patient, without interpretation of the patient’s response by a clinician or anyone else  [3]. Patient-reported outcome measures (PROMs) are used to measure patient-reported outcomes (PROs). In addition to PROMs, patient-reported experience measures (PREMs) have been suggested as a tool to measure patients’ experiences with received health services, often through a satisfactory score [4] PROMs can be one dimensional; patients reported symptoms of a specific disease or multi dimensional such as measures of quality of life. EQ-5D [5] is a multidimensional questionnaire that is widely used to measure the general quality of life with an individual or patient. The EQ-5D is an example of PROMs that is widely used to evaluate health services and treatments with a broad perspective [5]. The use of PROs in clinical practise may result in more accurate and comprehensive data regarding patient experiences and outcomes, and could improve the overall knowledge around the outcomes of specific health services and treatments [6]. PROMs surveys can be done using physical paper but are today often digitised since electronic followup presents an opportunity to enhance patient communication while also reducing costs [7].

A low response rate remains a significant barrier for broad implementation and use of PROMs in research and clinical practice; the response to PROM surveys seems to regularly fall below 50 % [8] [9]. This low response rate is prone to biases, and the ability to make any general conclusions from the collected data is limited [10].

We propose an incentive model where the patient gets reimbursed for completed digital PROMs surveys through decentralised tokens, often used in cryptocurrencies. The tokens are non-fungible, meaning that every token is unique and can only be used by the receiver. This would prevent a secondary market where the tokens are sold or traded since it only has value to the initial receiver. The tokens can be aggregated by the individual and exchanged for new health services from the same provider. We hypothesise that such a token will bring the same benefit as monetary incentives, but be more beneficial for the healthcare provider since they do not need to put up any monetary values upfront, but rather supply additional health services. The token, therefore also works as a customer incentive program; the patient needs to collect a number of tokens before they can be exchanged for a health service; this could increase customer loyalty [11].

Furthermore, the scheme developed in this work will be implemented to the concept platform VerifyMed [12]. VerifyMed provides a decentralised solution where healthcare professionals can prove their competence and experiences. The service is decentralized and has a high degree of transparency and provenance as a result of the blockchain foundation of which the service is built upon. PROMs are utilised in the services to serve as a verification of work history for the healthcare professional as well as to improve health services. It is crucial to gain a high participation rate in these PROMs surveys in VerifyMed, this scheme will therefore be of high value for the continued development and success of the platform.

The incentive solution aims to get a higher response rate. However, when PROMs is performed online and introducing incentives, the potential issue it might cause is that patients might only participate to obtain the financial benefits and answer the surveys casually or even randomly. This issue not only reduces the quality of the followup analysis that is based on those surveys but also wastes the resources of the healthcare providers. We solve this problem by applying IER (insufficient effort responding) detection on the encrypted PROMs. Patients complete the PROMs, encrypt the answers and send them to the healthcare provider. The healthcare provider performs the IER detection on the encrypted data, and only send rewards to exchange the decryption keys from the patients who have qualified PROMs.

1.1. Related work

Different incentives models have been tested to increase participation rates in surveys in healthcare and other fields [13]. These models include monetary offers [14], small gifts, donations [15] and lottery-based incentives [16]. Although small improvements of response rates have been reported from the various models [13] It seems that monetary incentives are the only method that has shown efficiency in practice [14] [17] However, the monetary incentives come with a downside of a high cost for the healthcare providers and are often infeasible due to the business model of the healthcare provider.

Decentralised methods have been recommended for the initialisation of various consent model sand payment for data flows [18]. One of the motivations of these decentralised ecosystems is to encourage patients to contribute more actively in medical information sharing as we mentioned above. One example of these decentralised ecosystems is MedRec [19] which is a blockchain-based platform for medical data management. Their design mainly focuses on keeping the integrity of the medical data and easier access for patients’ data among different healthcare services. The medical research community play the role of ’miners‘ in the blockchain and receive medical metadata as ’transaction fees‘. While the micro-payments for data sharing/trading is a side part of the design, which lacks more formal and dedicated architecture for this specific purpose. As far as we know, there is no incentive model for PROMs that get introduced in these decentralised systems. Meanwhile,  [20] has introduced a fair data exchange cryptographic protocol that has potential usages in trading medical data. They emphasised the importance of fairness in any data ecosystem where the incentives for trading data also motivate sellers (in our case, is the patient) to forge data for profits. Therefore, in our decentralised incentive model for completed PROMs, we introduce insufficient effort responding detection that can detect patients who give meaningless PROMs in high accuracy, and consequently increase the quality of the PROMs.

1.2. Aim and objectives

The overall aim of this research work was to explore, design and develop a decentralised and autonomous cryptography foundation for a non-monetary reimbursement of completed PROMs surveys.

Objectives: (1) Create a cryptographic scheme that verifies the authenticity of completed surveys and reimburses the patients with a non-fungible token. (2) Achieve a high level of transparency and decentralisation of the scheme through implementation on a consortium blockchain.

2. Materials and Methods

We construct a blockchain-based platform that allows healthcare providers to give decentralised tokens to patients as reimbursement for completing PROMs surveys, the tokens can be exchanged for additional health services from the same provider. The platform also provides IER detection to distinguish the patients who participate barely for the reimbursement but without carefully answer the surveys. The IER detection mechanism avoids the unfair situations where the healthcare providers paying for nonsense answers. We emphasise the importance of IER detection in Section 2.1. The platform can be easily integrated in the VerifyMed concept to ensure a high participation rate in patients surveys, which are a crucial feature in the VerifyMed concept.

We describe the process of a patient submitting its PROMs in Figure 3

Before a patient submits her PROMs, she needs to authenticate herself with the healthcare providers. PROMs can be based on a specific medical operation or a general survey. Therefore the patient can use her own identification that is already registered with the healthcare provider or a unique identifier of one medical operation to authenticate herself. Meanwhile, the healthcare services provider has already deployed a smart contract on the blockchain , which is used to distribute the incentives.

• Step 1. A healthcare provider sends a survey (for instance, an EQ-5D form) from a mobile application to the patient. The patient answers the survey through a smartphone or web browser. The results will be encrypted and sent back to the healthcare provider.
• Step 2. Upon receiving the encrypted result from the patient, the healthcare provider performs a validation check: it evaluates the encrypted data and sends some aggregated ciphertexts together with the expected plaintexts to the smart contract (the detailed validation check process is given in Section 2.1).
• Step 3. The patient sends the decryption key to the smart contract.
• Step 4. If the patient answer the survey as intended (not just randomly answering the questions), the smart contract will decrypt the aggregated ciphertexts that were received from the healthcare provider to the corresponding expected pre-determined plaintexts. In this case, the survey is validated, the smart contract records the key and sends rewards to the patient.
• Step 5. The healthcare provider reads the decryption key from the smart contract, decrypts the result from the patient.

We describe the background of IER detection in Section 2.1. A mathematical model to show how the healthcare provider presents the format of PROMs to its patients is provided in Section 2.2, furthermore, the technical solution for validation check for IER detection is given. In Section 2.3, we summarise the functionality of our system. The result and implementation is given in Section 3

Figure 1. The process of a patient’s PROMs submission. The procedures in grey domain are performed by patients; the procedures in orange domain are performed by health care services.

Figure 1. The process of a patient’s PROMs submission. The procedures in grey domain are performed by patients; the procedures in orange domain are performed by health care services.

2.1. Fair data exchange via blockchain and IER detection

In our system, the blockchain not only serves as a platform that provides decentralised tokens, but also serves as a trusted third party to handle the exchange process between tokens and PROMs. The traditional online data trading process requires either the patient (seller) to trust the healthcare provider first, in which case the patient submits PROMs to the healthcare provider before she/he gets any rewards; or the healthcare provider (buyer) sends the rewards firstly to the patient and believes the patient will complete the survey carefully. With the emerge of blockchain technologies, the decentralised property of blockchain can minimise the risk of those trusts from both patients and healthcare providers. From a patient perspective, as long as she/he follows the system instructions, she/he can be guaranteed to receive the decentralised tokens immediately after the healthcare provider receives her/his completed survey. At the same time, the system also guarantees that the healthcare provider receive reasonable feedback before sending tokens to the patient. We follow the blockchain-based fair data trading model in [20], where the data seller (patients) sends encrypted PROMs to the healthcare provider first, then sends the decryption key to the smart contract and receives the rewards (token) at the same time.

The IER detection mechanism detects surveys answered by patients in a careless, haphazard, or random fashion. We emphasise that IER detection is critical when patients get direct financial benefits to participate PROMs surveys since the participation rate might be increased due to the incentives, while at the same time, there might be more patients who complete the surveys barely for incentives but without paying attention to answer the questions carefully.

We use inconsistency checking, which is a typical IER detection method, to validate the surveys submitted by patients. This approach uses matched items/questions in a survey and these matched items are supposed to have the same response. We assume the respondents, who are not attentive, provide inconsistent responses for the matched items. Inconsistency scales have generally been effective at identifying random responses generated by participants with partial or no access to the questionnaire, as well as random responses generated by computer algorithm [21]. Traditionally, this method is applied to analyse the surveys that are in plain-text, we provide a novel method to enable inconsistent IER detection on encrypted data. We specify that it is impossible to prevent a patient from carefully providing wrong answers. We assume that if a patient answers questions carefully and properly encrypts the answers, then (s)he is not very likely to provide nonsense answers.

2.2. A mathematical model for PROMs and its encryption

We build a mathematical model for PROMs that only contains multiple-choice questions. The purpose of the modelling is to enable Insufficient Effort Responding (IER) detection on the encrypted PROMs and further exchange rewards and encryption keys via blockchain. The mathematical model of a survey and the mathematical preparation for inconsistent IER detection on encrypted data is given in this section.

In a mathematical model of a survey, we assume the total number of questions is l and there are q choices for each question. Each question, including its responses, is represented by a list with an index i: $L_i=\{0,1,...,q-1\}$, each number in the list denotes an answer/choice for the i-question and they are assigned randomly (apart from the matching questions we describe next). Among all the questions, the healthcare provider generates matching questions for IER detection, these matching questions require matching responses, we design the matching responses and their assigned numbers in a specific approach so that the numbers have determined summations.

More precisely, healthcare provider designs matching questions as follows.

• Choose two distinctive random numbers $i,j$ from $\{1,2,\cdots ,l\}$ and a random number $\mathsf{sum}$ from $\{0,1,2,\cdots ,q-1\}$. The matching questions will be embeded to the i-th and j-th survey questions.
• For $t\in \{0,1,2,\cdots ,q-1\}$, we assign t to a certain response of i-th question, then its mathching response in j-th question is assigned by a number $(\mathsf{sum}-t)modq$. Hence, the sum of these two questions’ matching responses will be $\mathsf{sum}$, we call it matching sum.

Given a concrete example, question i and j are a pair of matching questions, they both have responses as $(0.\mathit{highagree},1.\mathit{agree},2.\mathit{disagree},3.\mathit{highdisagree})$. If a careful patient chooses ‘high agree’ in question i, then he is supposed to choose ‘high disagree’ in question j (For example, the matching question can be ‘I have no problems with self-care’ or ‘I have moderate pain or discomfort ’. In this case, $\mathsf{sum}=3$, which means if a careful patient responds question 1 with respond t, (s)he will respond question 2 with respond $(3-t)mod4$.

Homomorphic encryption

We use homomorphic encryption  [22,23,24] to encrypt the responses. Homomorphic encryption is a form of encryption that allows one to perform computations on encrypted data without first decrypting it. Denote ${\mathsf{Enc}}_k\left(m\right)$ to be the encryption of the message m under key k, then the homomorphic property is that

$${\mathsf{Enc}}_k\left(m_1\right)+{\mathsf{Enc}}_k\left(m_2\right)={\mathsf{Enc}}_k(m_1+m_2).$$

Encrypting matching responses

Recall that matching questions can be used to check if the patients pay attention while responding a survey. Our construction requires the patients using a homomorphic encryption scheme to encrypt responses. The matching questions are designed to have matching responses sum up to a fixed value, that is the matching sum. By the homomorphic property, their encrypted results sum up to an ecnryption of the matching sum, we can use this property to do the validation check. How to perform a validation check will be shown in the next section.

Techniques for validation check

An overview of the validation check (including the preparation of the healthcare provider and the communication among healthcare providers, patients and smart contracts) is provided in Figure 3. We consider one pair of matching questions in the diagram to show the idea, validation check for multiple pairs of matching questions can be done by running multiple times of the matching question generation algorithm and sending multiple checking values to the smart contract to check the validation.

• The healthcare provider designs questions and sends all the questions $L_1,L_2,...,L_l$ to the patient.
• The patient answers the questions and encrypts the responses by a homomorphic encryption scheme. Suppose the response of question $L_i$ is $a_i$, then the encrypted value is $c_i={\mathsf{Enc}}_k\left(a_i\right)$, where k is the key of the homomorphic encryption scheme. Eventually, the patient sends the encrypted data $c_1,c_2,...,c_l$ to the healthcare provider.
• The healthcare provider performs an audition on the received ciphertexts. The audition process is to have an evaluation on the matching responses. Suppose the matching questions are $L_i$ and $L_j$, and the matching sum is $\mathsf{sum}$. The healthcare provider computes the addition of $c_i$ and $c_j$, denote the sum as $c_{\mathsf{add}}$, sends $(c_{\mathsf{add}},\mathsf{sum})$ to the smart contract.
• After receiving the decryption key k from the patient and some checking values $(c_{\mathsf{add}},\mathsf{sum})$ from the healthcare provider, the smart contract checks if $\mathsf{sum}$ equals to ${\mathsf{Dec}}_k\left(c_{\mathsf{add}}\right)modq$. If so, sends token to the patient and records the key k on the smart contract. Otherwise, rejects.

Remark. 

For careful responses, if the i-th question has response t, then the response of the j-th question will be $(\mathsf{sum}-t)modq$. In addition, if the key k sent by the patiient in step 4 is the correct encryption key of ciphertexts $c_1,c_2,...,c_l$, then $c_i={\mathsf{Enc}}_k\left(t\right)$ and $c_j={\mathsf{Enc}}_k((\mathsf{sum}-t)modq)$. Due to homomorphic property, we have $c_{\mathsf{add}}=c_i+c_j={\mathsf{Enc}}_k(t+(\mathsf{sum}-t)modq)$, hence the decryption output mod q will be $(t+(\mathsf{sum}-t)modq)modq=\mathsf{sum}.$ Which means $\mathsf{sum}={\mathsf{Dec}}_k\left(c_{\mathsf{add}}\right)modq$. Overall, the equation result of the above check implies the key k can help the hospital getting the expected survey responses and the patient does not provide a nonsense response. Additional benefit of this method is that the smart contract cannot learn any information about the survey responses, because the smart contract can only learn the matching sum, which is a fixed number for any responses.

2.3. Functionality overview

We build a decentralised system for reimbursement of completed PROMs surveys, the overall features and functionality are summarised as follows.

Privacy on blockchains

In our system, blockchains serves as a platform to give incentives to patients who complete PROMs in a decentralised, fair approach. The data that recorded on the blockchain includes an identifier for a certain patient or a certain operation, patients’ encryption keys, some additional information for IER detection. The identifier is random, disposable number that is only known by the healthcare provider and the patient who participates in a certain reimbursement process; the encryption keys are chosen randomly by the patients; the information for IER detection is encryption for numbers that contains no information of the survey. Hence, the information that recorded on the blockchain are not personal related. Besides, apart from the healthcare provider and the participating patient, others cannot link the information that recorded on the blockchain to a specific patient, patients can keep anonymous.

Figure 3. The process of a patient’s PROMs submission. †: $a_i$ is the patient response of the i-th question $L_i$. $††$: Assume the matching questions chosen by the healthcare provider are the i-th and j-th questions and the corresponding matching sum is $\mathsf{sum}$.

Figure 3. The process of a patient’s PROMs submission. †: $a_i$ is the patient response of the i-th question $L_i$. $††$: Assume the matching questions chosen by the healthcare provider are the i-th and j-th questions and the corresponding matching sum is $\mathsf{sum}$.

Fairness for both patients and healthcare provider

We use smart contract on blockchain to address the exchange of tokens and patients’ encryption keys (which give direct access of PROMs to the healthcare providers). In addition, we introduce a IER detection mechanism to ensure the healthcare providers only pay for the PROMs that has a reasonable quality. The IER detection, together with decryption keys validation checks are all performed by the smart contract, which means the transparency, fairness and correctness of the exchanging process follows by the security guarantees of the underling blockchain.

Compatible with VerifyMed

VerifyMed, a decentralised credential management system for healthcare professionals [12] [25] utilises PROMs as a means for verification’s of experiences for healthcare professionals. The aim is to get an objective measure of competence and experience, it is therefore essentials to have a high degree of responses in the PROM survey. The scheme presented in this work is tailored for the VerfifyMed system where the patient get to store their reward tokens in their digital VerfiyMed wallets. The tokens can be transferred to a healthcare provider by initiating a wallet to wallet transaction. This enables patients to "spend" their tokens to pay for new health services by the provider.

3. Result

3.1. IER detection accuracy

If a patient does not properly encrypt responses, due to the correctness of the HE scheme, the decryption result will not matches with the expected response. We suppose the patient will always properly encrypt responses in the rest discussion. Set each of the matching question have at least q options. When a patient respond with one of the matching questions, the response for the other matching question is also determined. Therefore if the patient randomly responses questions, the possibility to give the correct matching responses is $\frac{1}{q}$. Assume the patient randomly responses all questions, if the healthcare provider designs a survey with N pairs of matching questions, then the probability that the patient at most has one wrong response is $\frac{N(q-1)+1}{q^N}$.

3.2. Code and computation cost on smart contact

We list the pseudo code of the patients’ encryption algorithm, the validation check algorithms of the healthcare provider and smart contract. Patients use homomorphic encryption scheme: elliptic curve Elgamal encryption to encrypt EQ-5D.

Algorithm 1 Patients’ encryption

Algorithm 2 Healthcare provider validation check

Algorithm 3 Smart contract validation check

We implement a smart contract on Ethereum Remix platform and deploy it on test network. The implementation is limited to the procedures on blockchain, i.e. the validation check and rewards distribution to demonstrate their computation cost. The off-chain procedures, i.e. generate mathematical models and user interface are not given in the implementation. The code can be found in [26]

Table 1. Evaluation of the Processes on Blockchain.

Function	Cost in gas	Transaction size (byte)
Deploy smart contract	1057381	9120
Healthcare provider validation check submission	204064	394
Patient key submission	62367	74

Table 1. Evaluation of the Processes on Blockchain.

Function	Cost in gas	Transaction size (byte)
Deploy smart contract	1057381	9120
Healthcare provider validation check submission	204064	394
Patient key submission	62367	74

4. Discussion

To our knowledge, this is the first paper that presents an incentive mechanism for patients to deliver PROMs-related surveys and get reimbursed through a novel, non-monetary reimbursement scheme through smart contracts. As the literature suggests, there is a high need for incentive models that increase the participation rate in PROMs surveys [8] [9].

Limitations in our work include that currently, the platform is only designed for the EQ-5D survey. This should be developed further to work with a wide range of different PROs surveys. The patients need to store his or her tokens in a digital wallet, this may lead to some usability issues since these wallets can be difficult to manage for individuals with low digital literacy. As mentioned previously in the paper, the platform is planned to be integrated with the VerifyMed platform, which has a clear user-centric approach. This might increase the ease of use. However, this should be further explored.

We hypothesis that our incentive scheme will create a higher response rate than what is currently reported from other incentive schemes. This hypothesis should be tested in future research projects with real patients. The cryptography scheme designed in this work can potentially be used to incentives other types of data sharing, besides PROMs. This could for example be other types of participation data used for health research. Other types of use-cases should be further explored in future research.

We concluded that this work shows that a cryptographic scheme that utilises smart contracts on a decentralised platform is a valid alternative to give incentives and encourage patients to complete PROMs surveys.