Abstract
<title>Abstract</title> <p>The effective usage of healthcare data requires fine-grained and patient-centric access control. Existing systems often provide only static consent, lacking timely revocation, transparent auditing and compliance with privacy regulations such as GDPR. We propose a Blockchain-enabled Policy-Based Access Control (PBAC) framework to address these gaps. The framework supports patient-centric, auditable and privacy-preserving medical data sharing. The PBAC framework leverages smart contracts in Solidity to enforce dynamic consent and secure data access to ensure accountability through immutable transactions. The implementation was carried out on Hyperledger Besu, with benchmarking scripts developed in Python. Performance was evaluated under multiple consensus mechanisms like QBFT, IBFT2 and Clique considering latency, throughput, gas usage and resource consumption. Results demonstrate that the proposed PBAC system supports secure and GDPR aligned healthcare data sharing. The system also achieve a balanced trade-off between performance efficiency and patient autonomy.</p>