Don't you think it needs some kind of metadata protection?
Maybe SimpleX would be a better bet? If anything at all.
Why does this need to be over a formalised decentralised network again?
Can't the patients just hold on to it on their own devices and give it to whomever?