Verifiable identity and revocable consent across institutions.
Credara is shared infrastructure for two things US healthcare does badly: knowing that a patient seen at one institution is the same person seen at another, and keeping that patient's consent verifiable and revocable as their records move around. A peer-to-peer graph of signed events — with no central matcher and no node that ever sees cleartext PHI.
Two things US healthcare does badly.
US healthcare runs on patient records fragmented across institutions and on consent that is practically impossible to revoke. The rights to fix both already exist on paper — the infrastructure to enforce them does not.
Is this the same person?
Identity matching depends on probabilistic vendor algorithms run against opaque databases. The miss rates show up as duplicate care, missed allergies, contraindicated prescriptions, and avoidable readmissions.
Can the patient take it back?
A consent granted at one institution lives in that institution's database. When the patient revokes it, the revocation stays put — while copies of the records keep flowing elsewhere.
The legal regime assumes infrastructure that doesn't exist.
HIPAA grants patients the right to access records, restrict disclosure, receive an accounting of disclosures, and revoke authorization. The 21st Century Cures Act information-blocking rule attaches seven-figure penalties to anyone who impedes electronic health information flow. State and cross-border law assume the same. The rights exist; in practice, a patient who wants to enforce them makes phone calls and hopes.
Built for research that runs for years.
Credara is built for longitudinal research, where both problems compound over the years a study runs. A study lives or dies on identity holding over the full course of care — confirming a participant seen at one institution this year is the same person seen at another five years later, and keeping their authorization verifiable and revocable the whole way through.
A clear example of where it breaks today.
Lyme disease patients accumulate fragmented records across many providers and state lines over long, frequently disputed disease courses. When identity links break, the cohort fragments. When consent provenance gets murky, so does data governance — and the study's footing erodes year over year.
Composed into a single longitudinal record
A clinician in a new city sees the cardiology workup from two years ago, the medications from pharmacies across state lines, and the allergy noted by a pediatrician who has since retired. Rare diseases become recognizable patterns, polypharmacy interactions get caught, and care continuity across transitions stops resetting the chart to zero.
Peers contribute signed events to a shared graph.
Each participating institution — hospitals, health systems, QHINs, HIEs, payers — runs a peer that contributes signed, immutable identity and authorization events to a shared distributed graph. No central matcher, no leader nodes, no privileged intermediaries. Patients are identified by the chain of provenance behind every assertion, not a master patient index; authorization is itself a signed event any institution can issue, verify, or revoke.
When an institution creates an event, its peer pushes it to a handful of neighbors, who push it onward — the network converges in roughly log(N) rounds, about 1–2 seconds. Three distinct kinds of exchange flow between peers, and none of them ever carries cleartext PHI.
Event gossip
A new identity assertion, link, grant, revocation, or tombstone is gossiped peer-to-peer as a batch of signed CBOR event nodes inside an encrypted Noise channel.
UUID, and re-gossip.Anti-entropy
Peers periodically reconcile by exchanging a Merkle root over their sorted set of event UUIDs. Roots match → in sync. Roots differ → swap UUID sets and transfer only the missing nodes.
DHT routing & pulls
A Kademlia DHT maps a tokenized subgraph key to the peer IDs that hold it; a peer then makes a targeted point-to-point request for the actual event nodes.
AuthorizationGrant in CBOR — can travel this way too, handed to a relying party to verify locally.What never crosses the wire: cleartext PHI.
Only tokenized demographics and signed events move between peers. Demographics are tokenized before anything is gossiped, the DHT only ever sees tokenized keys, and clinical payloads never enter the trust graph — all inside encrypted, mutually-authenticated Noise channels.
Obligations enforced structurally, not by policy.
Because every assertion is a signed event in a shared graph, the rights that exist on paper become operations the network performs.
Verifiable, not probabilistic
Every assertion carries a chain back to the institution that observed it. Matching stops being a vendor's black box — confidence emerges from consensus across peers.
Consent that actually moves
A grant propagates network-wide within seconds; a revocation takes effect at every peer with bounded latency; an erasure request lands as a signed event the whole network must honor — under the patient's own key.
Accounting of disclosures by query
What is reconstructed today by hand from scattered audit logs becomes a single query against the patient's own provenance chain.
Beyond any one organization
Durability stops depending on any single institution. The right to access records does not expire when a clinic closes or merges.
Standards already in wide use — open to full review.
Credara aligns with the existing trust framework and is assembled from mature components. Only the healthcare-domain layer is new code. Its integration surface is HL7 FHIR R4 — a conformant interface served through HAPI FHIR, HL7's reference implementation — and institutional identity follows the UDAP profile of the HL7 FAST Security implementation guide, the standard US nationwide exchange adopted in 2026. So Credara speaks the same standards as the EHRs, HIEs, and QHINs it sits alongside. The cryptography is algorithm-agile and post-quantum ready.
| Core / Export Gate / Verifier | Rust |
|---|---|
| FHIR Bridge | Java / Kotlin — HAPI FHIR (HL7's reference server), Plain Server mode (not JPA) |
| FHIR conformance | HL7 FHIR R4 conformant interface, US Core–aligned · R5 deferred |
| Networking | libp2p — gossipsub, Kademlia DHT, Noise transport |
| Storage | RocksDB via a Store trait · substrate decided (§13.1.1) |
| Serialization | Canonical CBOR (ciborium, RFC 8949 deterministic encoding) |
| Hashing | Blake3 content integrity & Merkle roots · SHA-512 DHT routing key, FIPS-validated |
| Demographic tokenization | Salted Blake3 256-bit network salt, rotated annually — deterministic across peers, resistant to rainbow-table attacks. Cleartext demographics never leave the originating institution. |
| Node IDs | UUIDv7 |
| Signatures | Algorithm-agile — Ed25519 default; ML-DSA-65 (FIPS 204) & SLH-DSA (FIPS 205) for PQC; hybrid mode |
| Identity & trust | HL7 FAST Security IG via UDAP (institutional) + SPIFFE / SPIRE (workload) · admission modeled on DirectTrust · aligns with TEFCA |
| Deployment | Kubernetes-native — the Helm chart is the primary production target, with Ansible automating install onto an existing cluster (cert-manager + SPIRE + the Helm release). Local development runs under Podman or Docker Compose. |
| License | Apache 2.0 |
Pre-launch. All milestones implemented. Open for testers.
The technical specification (Sections 1–13 + appendices, ~90 pages) is complete and authoritative. All ten build milestones are implemented and verified; the multi-peer testbed under kind passes its gossip-convergence and anti-entropy-repair scenarios end-to-end.
Open source. Vendor independent. Open for testers.
Credara is Apache 2.0, so it can be reviewed in full rather than trusted as a black box — no central coordinator, no lock-in. Bring a laptop with Docker and stand up a real two-peer network in minutes.
make -C testbed up && make -C testbed smoke
docs/STATUS.md — the authoritative map of what's real vs. demo — before building on any surface.