<p>Conventionally, patients share their EHRs with healthcare providers, such as hospitals and research institutes, to improve the quality of treatment. The healthcare systems rely on the trusted third parties to manage patients’ EHRs. Although the trusted third parties facilitate EHR management, they are highly susceptible to attacks from insider and outsider adversaries. Moreover, there is a need to protect patients’ privacy when there are active insider adversaries. In addition, to encourage patients for sharing EHRs, one of the mechanisms used by the healthcare systems is to provide incentives to patients. In isolation, the privacy preservation of EHRs and the distribution of incentives, are not challenging issues. We can use conventional security mechanisms to protect the privacy of EHRs and to distribute the rewards. However, when the objective is not only to ensure the privacy preservation of EHRs, but also the distribution of incentives, the conventional security mechanisms fail to address the issue. To distribute the incentives, the healthcare systems must know and validate the identities of patients. However, the identities of patients obstruct the privacy preservation of EHRs. In this paper, we propose a mechanism to preserve the privacy of EHRs while facilitating the rewards’ distribution. We evaluated the security strength of the proposed mechanism in the presence of active insider and outsider adversaries. We analyze the efficiency of the proposed mechanism and provide a prototype implementation. The performance analysis shows that the proposed mechanism reduces the processing and storage overhead.</p>