This is a systems architecture question.
I'm in the process of planning an online platform that will collect people's medical information. Because of the extremely sensitive nature of the data being submitted, I want to ensure complete anonymity.
A profile would be created that would contain all of the data, but none of it would be personally identifiable- their condition, symptoms, medications, outcomes of tests, dietary information, etc, but no name, dates (maybe the year of birth), location, etc. I'd even like to avoid having any contact information, including email address.
However, this present some logistical challenges, to say the least:
- How to prevent spam and duplicate registrations
- How to provide password reset tools if I don't have an email address (or do anything about account hijacking, if the password is disclosed)
- How to accommodate 'registration by invitation only' while maintaining anonymity
I was wondering if a two system approach might work. If I had Site A where people could enter their basic identity details: name, email, etc and be validated as a real person, and perhaps issue invitations and permissions to other people to register.
This would provide them with a hash that could be entered into the Site B that would check against all available hashes from the Site A, and if it found a match, it would allow people to proceed with their anonymous registration on Site B.
The hash would be removed from Site A's list of available hashes, and the hash would not be recorded by Site B- removing any record-specific link while still ensuring validating the user is real, and having some control over repeat registrations. Would this work?
I know how convoluted this sounds, but I just don't want to have the personal data stored for people to hack. If a breach of Site A was able to determine that a specific person registered and then used their token on Site B, but there was no 1-to-1 link between any Site A user and any Site B record, then I could live with that.
As for the logistics of verification- I propose that the user, having been authenticated with the hash, is able to set up a username and password they use to access the site.
In order to provide security, I might suggest that they use 2FA, but would that require storing anything that could be used to link the account with a certain individual? Any such thing as truly anonymous 2FA? I'd be fine with having a no logging policy, but I don't know if 2FA requires a stored email address or ID with google that could be used to make a connection.
Id be very pleased if anyone was aware of a similar use case where an acceptable solution had been found. Maybe there is already a provider that can be used (as Site A)?