Abstract

A method and system for moving a completed health questionnaire from a respondent's device to one of several examiners at a temporary clinic, without any server, account, or database holding the questionnaire. The respondent's device serializes and compresses the answers, encrypts them once under a fresh random content key, and wraps that content key separately to the public key of every examiner on the clinic's roster. The result is displayed as an optical code (for example a QR code) that is itself the record. Each examiner's device generates its own key pair locally, shares only the public key, and never exports the private key. A clinic administrator aggregates the examiners' public keys into a single recipient set, closes the roster, and publishes the set inside the link encoded on a printed entrance sign, so a respondent scanning the sign obtains a form already bound to that day's examiners. Any examiner on the roster scans the respondent's code and decrypts with their own private key; the decrypted record pre-fills an official jurisdictional form, which the examiner reviews in person, completes, prints, and signs on paper. At close-out each examiner device destroys its private key, rendering every outstanding code permanently unreadable. Variants cover single-examiner and spoken-code modes, human-verifiable key fingerprints against key substitution, freshness limits in place of revocation, multi-frame (animated) optical transfer for payloads that exceed one code, hybrid post-quantum key establishment with a suite identifier for algorithm agility, an integrity-pinned offline application cache, and generalization to other questionnaires, carriers, recipient structures, and outputs.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS