A method performed by a processing system includes determining a location in a metadata tree of a patient for an electronic health record, generating a record key for the electronic health record based on the location and a provider key corresponding to a provider, the provider key generated from a patient key corresponding to the patient, encrypting the electronic health record using the record key to generate a encrypted record, and providing the encrypted record to an encrypted data store.