The recent trend towards the use of a blockchain as a means to guarantee the security of health data has raised concerns with regard to its applicability in Internet of Things (IoT) scenarios due to computationally heavy primitives (e.g. hashing functions) and lack of scalability. As a solution to this problem, this article introduces Rabbit-256: an addition–rotation–XOR-based sponge construction derived from the Rabbit stream cipher that is twisted and adapted to a lightweight hash function, suitably adapted for distributed solutions in healthcare systems with a blockchain nature. Rabbit-256 is a lightweight encryption cipher that wears the mask of a hash function but with better diffusion and avalanche through an official buildup in Merkle trees. The presented system is evaluated using common cryptographic measures against SHA-256, i.e. grid operators of 100, 500, and 1000 inputs for the avalanche effect, Hamming distance, and mean standard deviation. We observe that Rabbit-256 exhibits a higher security margin and lower computational overhead, and thus, it is an optimal alternative to resource-constrained IoT systems given its resistance against attacks. Although the current work is developed in simulation, Rabbit-256 can be utilised for actual deployment to ensure the privacy of e-health records and medical sensor data in IoT and clinical services over a blockchain. In the future, we will focus on hardware design, energy efficiency, and integration (i.e. to be compliant with the Health Insurance Portability and Accountability Act in the U.S. and the General Data Protection Regulation in Europe).