Mai, a 36-year-old teacher in Ho Chi Minh City, needed a specialist referral for suspected diabetes. Her general hospital sent the referral to a district-level endocrinology clinic through the national health insurance (BHYT) channel. What actually travelled was not the single question "is Mai covered and does this diagnosis need a specialist?" — it was her entire bệnh án: ten years of prescriptions, a mental-health consultation from 2019, family history, even a list of medications she once stopped taking. The receiving clerk, the insurer's system, and three nurses all had full read access. This is the central problem of Vietnam's otherwise impressive EMR rollout: digitization happened, but zk dữ liệu y tế — zero-knowledge proofs applied to health data — is the missing layer that lets a hospital verify a claim about a record without ever shipping the record itself.
Vietnam's EMR revolution is real — and so is the over-sharing problem
Vietnam has spent the last two years forcing a paperwork revolution. Circular 13/2025/TT-BYT, effective July 21, 2025, made electronic medical records (EMR) mandatory — hospitals by September 30, 2025, and every facility with inpatient, day or outpatient care by December 31, 2026. Every EMR must link to the citizen's electronic identification account, carry a doctor's digital signature, and obey the full stack of personal-data, network-security and electronic-transaction law. The Ministry of Health, pushed by Directive 07/CT-TTg from March 2025, aims for 100% of hospitals to exchange records across tiers so patients stop paying for the same blood test twice.
The results are real. By early 2026 the National Health Information Centre reported roughly 30 million digital health records accessible through the VNeID application across all 34 provinces and cities, and more than 1,000 hospitals running electronic records. BHYT covers around 92% of the population, and level-2 VNeID users can already pull their medical history, insurance card and e-prescriptions from their phone. Hospital chains and vendors have raced to supply the plumbing: VNPT EMR, Viettel EMR deployed in roughly fifty facilities, FPT.EMR inside private groups like Hoàn Mỹ, and hospital information systems (HIS) from the same three vendors dominating the market.
What the law does not regulate is how much of a record may be shared to answer a small question. Referrals, insurance pre-authorizations and cross-hospital consultations are implemented as file transfers: the hospital answers "is this diagnosis covered?" by copying the whole EMR into the channel. A 2025 study of five Vietnamese hospitals found that only two were even confident about exchanging clinical data over HL7 standards — and none were actually doing it. In practice the system is a set of silos that, when forced to talk, over-share instead of under-share.
One field shared = the whole bệnh án travels
Walk through what happened to Mai in concrete terms. The general hospital had to answer three yes/no questions: Is this patient on BHYT? Does the diagnosis fall in the covered package? Is specialist care indicated? None of those questions requires Mai's medication history, her prior mental-health notes, or her family tree. Yet the referral workflow shipped the entire record to every party that touched the case.
Figure 1: The over-sharing problem — one field asked, whole bệnh án travels
This is the disease that zero-knowledge cryptography cures. The phrase "privacy health records" usually conjures encryption, access lists and passwords — but encryption protects a file in storage; it does nothing when the file is copied to a receiver as part of a legitimate workflow. Mai's record is encrypted in Hospital A's database and fully decrypted in the insurer's database ten minutes later. The minimum necessary rule from data-protection law — only the fields needed for the purpose — is stated on paper and violated by every file-based referral API in production.
What zk dữ liệu y tế actually proves
A zero-knowledge proof answers one question with a mathematical guarantee and shares nothing else. Hospital A does not need to send Mai's record to prove that her diagnosis is covered; it needs to prove a statement about the record: "this signed EMR contains a diagnosis in the BHYT covered set," or "this patient's record shows specialist care is indicated." The proof is a short string that any verifier — the receiving clinic, the insurer, the health ministry — can check without seeing a single clinical field.
The practical architecture is selective disclosure from a verifiable credential. When Mai visits a doctor, the hospital issues a digital credential — a signed document containing specific claims, not the raw EMR — and Mai holds it in a wallet tied to her VNeID identity. When the specialist asks "covered for this diagnosis?", Mai's wallet generates a proof from the credential that answers exactly that, leaving the diagnosis itself private if the question does not require it. This is the same machinery used for vaccination-status checks, clinical-trial eligibility screening and insurance pre-authorization worldwide, built on standards like the W3C verifiable credential model and signatures that support partial disclosure.
Figure 2: Selective disclosure — the verifier checks the proof, never the record
For a real circuit, the statement is compiled into arithmetic. A Circom or similar circuit takes the credential fields as private inputs and the question's public inputs — say "diagnosis class = covered set" — and outputs a proof of that relation. On a modest laptop, generating such a proof takes seconds; verifying it takes milliseconds. Verification can run on the hospital's server, inside a smart contract, or on a blockchain anchor where the proof becomes an auditable record. The critical property is selectivity: Mai decides — or the hospital's policy decides — what the proof may reveal.
How bệnh án số blockchain changes the trust model
Put the pieces together and you get a different shape of system, which is what the phrase bệnh án số blockchain really points at. Not "medical records stored on a blockchain" — putting raw clinical data on a public ledger is reckless, slow and illegal under Vietnamese data law. Instead, the ledger carries anchors: hashes of records, signed credentials, consent events and proof-verification receipts. The record itself stays inside the hospital's VNPT or Viettel EMR; the chain proves that it existed, that a credential was issued for it, and that a verifier checked a proof at a given time.
This is precisely the model the Cardano ecosystem has converged on. Cardano's own healthcare use-case documentation describes health data as fragmented across providers with patients holding no control over access — and the fix as patient-held ownership and portable access. Catalyst-funded projects such as UzimaNexus propose an SDK that anchors HIS, PACS and LIS outputs on Cardano while consent lives in patient keys, and the Vietnam-based CareBlock proposal applied the same reasoning to BHYT claims. None of them asks a hospital to abandon its EMR; they add a liability-and-consent layer on top. That matters in Vietnam, where the existing HIS vendors are entrenched and no hospital is going to rip out its system to chase a new architecture.
The consent event is the part that matters most for Mai. Today, "consent" is a checkbox on an admission form. With an anchor chain, every share — every referral, every insurer read, every researcher request — is a signed transaction that Mai's key authorizes, recorded permanently. If a nurse's account reads her file, there is an auditable trail of exactly what was revealed. Patients stop hoping the hospital is honest and start being able to verify.
Compliance: ND 13/2023, HIPAA and GDPR already point this way
Vietnam's Decree 13/2023/ND-CP — and the Law on Personal Data Protection that succeeded it in January 2026 — classifies health status and private life recorded in medical records as sensitive personal data, the most protected category in the legal system. Processing it demands stricter consent, a registered data-protection unit, and a 72-hour breach notification to the Ministry of Public Security if anything leaks. HIPAA's "minimum necessary" rule and GDPR Article 25's data-protection-by-design principle say the same thing from different jurisdictions: you may only use the data you actually need for the purpose.
Zero-knowledge proofs are the only mainstream technique that makes "minimum necessary" enforceable rather than aspirational. When the proof replaces the record in an insurer transaction, the insurer never holds the clinical fields — so there is nothing to breach, nothing to notify the ministry about, and no record to protect under the sensitive-data regime for that transaction. Regulators have not yet written ZK or verifiable credentials into Vietnamese law, so this is a compliance strategy, not a compliance checkbox. But the direction of the law is unambiguous: it penalizes unnecessary disclosure, and ZK is the mechanism that eliminates it.
The honest tradeoffs: cost, integration and regulation
No technology this useful is free, and the Vietnamese rollout is early enough that the costs are visible.
Proving cost. Generating a proof is the expensive step — seconds on a laptop, heavier on a phone, and circuit updates need re-audits. Verifying is cheap: milliseconds. For a one-time specialist referral or a BHYT pre-authorization this is negligible; for a telehealth app that verifies identity every session it becomes a UX problem. The answer is to size the circuit to the question and cache proofs where the facts do not change.
Integration difficulty. The bottleneck is not cryptography, it is the HIS. Vietnamese hospitals run heterogeneous systems from three vendors, most with no live HL7/FHIR exchange, and a proof layer assumes a credential can be issued from an EMR in the first place. The anchoring approach — SDK over the existing EMR, credentials issued at the edge — exists precisely because it fits current workflows instead of replacing them.
Regulatory ambiguity. No Vietnamese decree recognizes a zero-knowledge proof as a valid legal answer to a data request. Hospitals cannot cite a ZK system as a statutory compliance method yet, and cross-border proof verification could raise transfer-assessment questions. Pilots must run in parallel with paper-and-signed-record fallbacks.
Figure 3: Current vs ZK health record sharing — the trade-off is seconds of proving time vs whole-record exposure
What Vietnamese patients and health-tech teams can do now
For a patient like Mai, the immediate practical advice is boring but honest: use VNeID level-2, keep track of what you have signed, and ask your hospital what a referral actually sends. For health-tech teams, the beachhead use case is BHYT pre-authorization — high value, legally mandated, and exactly the transaction where over-sharing is visible today. Build a pilot that issues a verifiable credential from an existing EMR, generates a proof for the coverage question, and lets the insurer verify it without receiving the record. Run it in parallel with the existing file-based flow and measure the difference in exposed fields.
The deeper lesson is that blockchain's role is not storage but proof. A blockchain anchor makes the issued credential, the consent and the verification auditable by everyone — including the patient — while the record stays where it belongs. Cardano's tooling for anchoring and verifiable credentials is mature enough for a pilot, and the model of "anchor on-chain, store off-chain, prove selectively" is the only version of bệnh án số blockchain that Vietnamese regulators could accept today.
Frequently asked questions
Does zk dữ liệu y tế work with BHYT and VNeID today?
Not end-to-end yet. BHYT and VNeID already carry electronic medical history and insurance data, and Decision 31/QĐ-BYT gives VNeID-hosted health records legal value. What does not exist is a ZK proof layer on top — hospitals still share whole records through referral and insurer channels. The infrastructure for issuance (VNeID as identity anchor) is in place; the proof layer is the missing component.Is the whole medical record stored on a blockchain?
No, and in Vietnam it should not be. Public ledgers are not a place for clinical data — the raw record stays in the hospital's encrypted EMR. The blockchain holds hashes, issued credentials, consent signatures and proof receipts. This is the anchoring model used by Cardano healthcare projects and the only design consistent with Vietnamese data law.Who issues the verifiable credential in this model?
The treating hospital, which signs the credential with its digital signature — the same signature Circular 13/2025/TT-BYT already requires on every EMR. The credential contains specific claims derived from the record; the patient holds it and controls which claims are revealed through a proof. Credentials can be anchored so a verifier can confirm the issuer without contacting the hospital.What happens if a patient loses the wallet with their private key?
The same thing that happens when anyone loses a private key: access is lost. This is why the design keeps the hospital as the record of truth — the wallet is the access control, not the storage. Hospitals must offer key-recovery and re-issuance procedures, and patient education about self-custody is a prerequisite for adoption.Can ZK stop every health-data breach in Vietnam?
No. ZK minimizes what is transmitted and shared, which removes the largest everyday exposure — over-sharing in legitimate workflows — and shrinks breach damage. It does not protect the hospital database itself, does not fix weak access control, and does not stop a malicious insider who already has the file. It is a layer, not a firewall.What is the first realistic ZK health pilot in Vietnam?
BHYT pre-authorization. A hospital issues a credential, the patient's wallet generates a proof of "covered diagnosis + indicated specialist care," and the insurer verifies the proof without receiving the record. It is small, legally relevant, and produces a measurable drop in exposed fields — the ideal demonstration before any broader rollout.Conclusion
Mai's referral did not need to leak a decade of medical history to answer three yes/no questions. Vietnam has built the hard part — mandatory EMRs, a national identity hub in VNeID, near-universal insurance coverage — and the missing layer is exactly what zk dữ liệu y tế provides: a way to verify a claim about a record without shipping the record. Combined with on-chain anchoring of credentials, consent and proof receipts, it gives patients auditable control instead of a checkbox, and it gives hospitals a credible path to the data-minimization that ND 13/2023 and its successor already demand. The tools — verifiable credentials, Groth16 circuits, Cardano anchors — are production-grade today. What Vietnam needs is the first honest pilot: a hospital, an insurer, and one patient who proves she is covered without anyone ever seeing her bệnh án.
Quick Reference
| Property | Current Record Sharing | ZK Proof Sharing |
|---|---|---|
| What travels | Entire EMR file | A short proof of one statement |
| Fields exposed | All — diagnosis, history, prescriptions | Only what the proof reveals |
| Data minimization | Aspirational (paper rule) | Enforced by cryptography |
| Insurer data risk | Holds full clinical records | Holds only a proof |
| Breach impact | Whole file per event | Proof only, no clinical fields |
| Legal fit (ND 13/2023) | Over-sharing risk; 72h breach duty | Supports minimisation principle |
| Per-transaction cost | ~0 (copy the file) | Seconds of proving, ms of verifying |
| VNeID fit | Identity used as data link | Identity used as credential root |
| Production today | Every BHYT referral | Pilots (clinical trials, vaccination, pre-auth) |