Federated Blockchain Learning to Support Root-Cause Analysis of Medical Incidents

Incident reports help health care organisations learn from patient harm, but they stay inside each institution, and their cause analysis is slow and manual. We present MIRR-FL, a consortium system in which smart contracts on a permissioned blockchain enforce each incident’s lifecycle, while a federated classifier governed on-chain proposes its primary contributing factor for an administrator to validate, supporting, not automating, root-cause analysis. TLA+ model checking found a defect, now fixed, that could leave incidents stuck. An incident’s six transitions cost 368,293 gas, and on a single-host multi-validator Hyperledger Besu testbed, one and four validators committed up to 120.1 submissions per second, the bound set by the block gas limit. On synthetic multi-institution data with known Bayes-optimal accuracy, plain federated averaging (70.6%) did not outperform local models (74.3%) under strong heterogeneity, whereas personalised federated learning reached 75.5%, within 1.0 points of the optimum. A three-sigma outlier rule can never reject an update among ten institutions; Multi-Krum kept at least 70.0% mean accuracy against five poisoning attacks by up to two malicious institutions. An honest-but-curious aggregator reconstructed records completely from single gradients but at most 0.22% from MIRR-FL’s whole-epoch updates, and differential privacy with nominal ε of 4.0–8.1 per institution cost no measurable accuracy. Code and results are released.