The GenoVault PO Box

1. Abstract

Clinical genomic laboratories — even the largest US providers — deliver raw genetic results to their patients using a workflow that has not meaningfully evolved since the early 2010s: an encrypted ZIP file attached to email, a symmetric password mailed separately, and a set of signed download URLs that expire 24 hours after issue. Patients who do not download immediately lose access. There is no cryptographic proof of delivery, no audit trail visible to the patient, no mechanism for revocation, and no path to satisfy GDPR Article 17.

This paper introduces the GenoVault PO Box: a HIPAA- and GDPR-compliant clinical-delivery protocol implemented on GenoBank.io infrastructure. The lab pastes the same signed URLs into a single textarea on a magic-link-authenticated page; the GenoBank backend streams the bytes directly into the patient's encrypted Google Cloud Storage vault before the URLs expire; a BioNFT representing the casefile is minted under the patient's wallet on the Sequentia blockchain (chain ID 15132025); and a LabDeliveryReceiptNFT is minted to provide cryptographic, on-chain evidence of delivery shared between the lab and the patient. The lab rep is never required to install a browser plugin, sign with a wallet, or memorize a password.

The protocol is currently in production beta on Sequentia mainnet with a small cohort of US clinical-lab partners (under NDA). The architecture, smart-contract surface, code paths, compliance mappings, and threat model are documented below; partner case studies will be published as each lab's BAA framework matures.

2. A motivating case: how the industry ships clinical genomics today

The pattern below describes the standard US clinical-lab raw-data release workflow as it operates across multiple top-tier diagnostic providers in 2026. It is reconstructed from first-hand patient experience and the public correspondence trails of three independent clinical labs; no individual lab or patient is named. We refer to the lab in question simply as "The Lab".

The patient experience

1. The patient (or their physician) requests raw genetic data files from The Lab's Customer Care function.
2. Within minutes, two emails arrive in the patient's inbox seconds apart:
   • The first carries a password-encrypted ZIP file attachment containing a plaintext links_to_files.txt with two or three signed download URLs (typically one tokenized DNAnexus URL for a VCF plus one or two AWS S3 presigned URLs for BAM files).
   • The second carries the ZIP's symmetric decryption password in cleartext along with a disclaimer that the URLs will expire 24 hours after the email was sent.
3. If the patient downloads within 24 hours, they end up with multi-gigabyte BAM files on their personal device with no recipient verification, no audit trail, no integrity proof, and no revocability path. If they miss the 24-hour window — which the average non-technical patient does — they must call Customer Care, request a fresh casefile generation, wait for the same email pair to arrive again, and try a second time.

The same workflow seen through a forensic lens

Walking through the actual byte path: the AWS S3 presigned URLs embed an Expires= Unix-epoch query parameter; when consumed after that epoch they return HTTP 403 Forbidden with an x-amz-id-2 header confirming signature expiry. DNAnexus-tokenized URLs return HTTP 401 Unauthorized when their issuance window closes. The patient, who almost never carries the technical vocabulary to debug presigned-URL signatures, can only repeat the cycle.

3. The problem with current clinical delivery

The pattern most US clinical labs ship today reflects an implicit cost/risk trade where the lab optimizes for its own data-egress liability at the expense of patient utility:

4. The GenoVault PO Box solution

The GenoVault PO Box is a digital post-office-box owned by the patient. The lab — in possession of the same short-lived signed URLs the patient already cannot use — opens a magic-link-authenticated page in their browser, pastes the URLs into a single textarea, and clicks Deliver Securely. The GenoBank server then:

1. Validates each URL against a per-delivery hostname allowlist (rejecting SSRF and arbitrary outbound).
2. Verifies the URL has at least two hours of remaining validity (so multi-GB BAMs can be streamed without the URL expiring mid-transfer).
3. Streams the bytes directly into a Google Cloud Storage object whose path is bound to the patient's wallet, computing a SHA-256 fingerprint on the fly.
4. For BAM files, runs samtools index against the GCS object so the patient can use GA4GH htsget streaming without re-downloading.
5. Registers each delivered file as a child BioAsset under the patient's parent biosample BioNFT (BioRouter, Sequentia chain 15132025).
6. Mints a LabDeliveryReceiptNFT with a keccak256 manifest hash, file count, and total bytes — under the patient's wallet — using the lab's authorized custodial signer.
7. Emails the lab rep a co-branded PDF receipt with file SHA-256s, a QR code linking to the Sequentia transaction, and HIPAA/GDPR claim footer.
8. Surfaces the case in the patient's existing /consent/biofile/<wallet> dashboard under a new "Clinical Lab Inbox" tab.

The patient pays nothing, the lab pays nothing, and the lab rep has the same friction profile they had with the encrypted-ZIP flow (in fact, lower — they no longer have to remember to send a follow-up password email).

5. System architecture

5.1 End-to-end flow

5.2 Smart-contract surface (Sequentia 15132025)

5.3 Off-chain components

• API (CherryPy): /api_clinical_inbox/{create_case, case_lookup, ingest_urls, case_status, list_for_owner} on genobank.app. Wallet-scoped MongoDB collections clinical_inbox_cases + clinical_inbox_audit.
• Storage: Google Cloud Storage bucket gs://genobank-vault, AES-256 at rest (CMEK via Cloud KMS available for BAA counterparties that require it). No AWS S3, no IPFS (IPFS is non-deletable and incompatible with GDPR Art. 17).
• Streaming reads: GA4GH htsget v1.2 endpoint at htsget.genobank.app — patient can run biofs view <bioipId> locally to pipe a BAM through samtools view without re-downloading.
• Audit: Per-chunk Mongo clinical_inbox_audit records (timestamp, source-host-redacted, byte range, SHA-256 progress); on-chain AccessGranted events from BioRouter for downstream re-disclosure tracking.
• Custodial signer: Each lab's Fernet-encrypted private key lives in /home/ubuntu/.lab_wallet_master_key on a hardened GCE VM; signing is loopback-only and gated by both admin authorization and the magic-link token (mirrors GenoBank's prior sign_as_donor protocol).

6. HIPAA compliance mapping

HIPAA Privacy and Security Rules apply when a US clinical lab discloses Protected Health Information (PHI) to a Business Associate or patient. The mapping below is intended for use in a clinical lab's internal HIPAA risk analysis (45 CFR §164.308(a)(1)(ii)(A)).

7. GDPR compliance mapping

For US clinical labs that also serve EU residents (NIPT, hereditary-cancer, and oncology products are sold in the EU through distributors by most major US labs), GDPR adds requirements that HIPAA does not address — most critically the patient's right to erasure (Art. 17). The archaic flow's reliance on emailed ZIP files makes Article 17 effectively impossible to honor.

8. Cryptographic delivery receipts

The LabDeliveryReceiptNFT contract on Sequentia (chain ID 15132025) implements an ERC-721 where each token represents one delivered casefile. The minted token is owned by the patient's wallet, gated minter is the lab's authorized custodial signer. The receipt's payload:

struct ReceiptData {
    uint256 labSerial;        // LabNFT_v2 serial of the delivering lab
    string  caseId;           // lab's own case identifier (e.g. "Casefile_NNNNN")
    address recipientWallet;  // patient
    bytes32 manifestHash;     // keccak256 over sorted (filename, sha256, size, fileType)
    uint8   fileCount;
    uint256 totalBytes;
    uint256 deliveredAt;      // block.timestamp
}

event CasefileDelivered(
    uint256 indexed tokenId,
    uint256 indexed labSerial,
    address indexed recipientWallet,
    string  caseId,
    bytes32 manifestHash,
    uint8   fileCount,
    uint256 totalBytes,
    uint256 deliveredAt
);

The manifestHash is a deterministic keccak256 of the JSON-encoded sorted file manifest [(filename, sha256, size, fileType), …]. Either party can recompute it from the files they hold and verify equality with the on-chain commitment — a zero-trust proof of delivery that survives any dispute.

The accompanying PDF receipt emailed to the lab rep includes the file SHA-256s in plain text, a QR code linking to the Sequentia explorer transaction, and a HIPAA/GDPR claim footer that the Privacy Officer can paste into their internal compliance log.

9. Trust & threat model

GenoVault assumes the following threat actors and explicitly defends or accepts each:

10. Business Associate Agreement framework

GenoBank.io enters a HIPAA Business Associate Agreement with each onboarded clinical lab. The template's salient provisions:

• Use and disclosure limits. GenoBank may use the lab's PHI only to (a) operate the GenoVault PO Box service, (b) maintain the patient's vault under the patient's instructions, and (c) provide breach notification.
• No subcontractor without BAA. Subcontractors (GCS, Sequentia validators, htsget) are themselves BAA-bound through Google's Cloud BAA and GenoBank's validator agreements.
• Audit access. The lab may audit GenoBank's logs, including the on-chain receipt set and Mongo audit collection, on 30-day notice.
• Termination. On termination, the lab's BioNFT minting authorization is revoked on-chain; existing patient BioNFTs continue to function — patients are never stranded by a B2B contract dispute.
• Indemnification. Mutual; capped at fees over the trailing 12 months, except for breaches of confidentiality (uncapped) and willful misconduct (uncapped).
• Governing law. Delaware; arbitration in San Francisco.

11. Implementation status

The GenoVault PO Box is in production beta on Sequentia mainnet (chain ID 15132025). The receipt smart contract is deployed and verified, the off-chain backend runs in a hardened Google Cloud Engine environment, and the lab-facing drop-off page is live at genobank.io/secure-hipaa-inbox/. A small cohort of US clinical-lab partners is currently onboarding under NDA-bound pilot agreements.

The adversarial test suite that ships with the protocol exercises the full perimeter on every deploy: server-side hostname allowlist (rejects arbitrary inbound URLs), SSRF defense (rejects RFC 1918, link-local, and cloud-metadata destinations), URL-expiry guardrail (rejects signed URLs with less than two hours of remaining validity), magic-link token-replay defense (single-use semantics + 7-day TTL + brute-force rate-limit), and custodial-signer abuse defense (loopback-only + admin-gated + magic-link-bound, modeled after the existing GenoBank sign_as_donor protocol).

Detailed deployment milestones — specific contract addresses, partner lab identities, per-case metrics, and pilot case studies — will be published as each lab partner's BAA framework reaches public-disclosure readiness. Interested labs and Privacy Officers can request a private briefing at calendly.com/uribedaniel.

12. Roadmap

v1.1 — Q2 2026

• OAuth federation for labs that prefer SSO over magic links (Microsoft 365 + Okta).
• Multi-patient batch ingestion (single case_id with N child patient wallets).
• Story Protocol PIL #7 auto-attachment for delivered files (permanent IP-licensing layer alongside revocable Sequentias BioPIL).

v1.2 — Q3 2026

• Patient-derived KMS keys (Lit Protocol or similar) for at-rest re-encryption — lab never has the decryption key.
• FHIR-native case metadata in addition to canonical bioinformatics formats.
• Pediatric / incompetent-patient consent flows (guardian co-signing on the magic link).

v2.0 — H2 2026

• Bidirectional flow: patient publishes outbound BioNFTs to a research lab through the same primitive.
• Native Apple Health / Google Fit integration on the patient side.
• Insurance carrier integration: BAA-bound carriers can receive policy-relevant subset via revocable token.

13. Contact & about the author

Daniel Uribe is the founder and CEO of GenoBank.io, where he has been building patient-owned biobank infrastructure since 2018. He is the inventor of the BioNFT (Web3-native consent token for genomic data) and the architect of Sequentias, GenoBank's purpose-built EVM chain for biodata routing. GenoBank.io operates 42 partner laboratories, serves 10,000+ patient wallets, and has cited prior art on biodata-tokenization infrastructure (including the UK Parliament's National Blockchain Roadmap, July 2021, p. 33).

To pilot the GenoVault PO Box at your lab, schedule a 15-minute conversation: calendly.com/uribedaniel.