•A framework for data security in mobile cloud platform developed.•Optimal Pixel Repetition based cover image generation instead of conventional interpolation, used, to achieve reversibility.•Pixel permutation is used to embed data and ensures histogram invariance between cover and stego-images.•Blind data extraction i.e., for the extraction of EPR from the stego-image, the original image is not required.•High embedding capacity of about 1.25 bpp is achieved. Internet of things (IoT) coupled with mobile cloud computing has made a paradigm shift in the service sector. IoT-assisted mobile cloud based e-healthcare services are making giant strides and are likely to change the conventional ways of healthcare service delivery. Though numerous approaches for preventing unauthorized access to information exchanged between a mobile phone and cloud platform do exist, but there is no security mechanism to prevent unauthorized access by the cloud administrators. With an aim to ensure security of client data such as Electronic Patient Records (EPR), we propose a novel high-capacity and reversible data hiding approach for securely embedding EPR within the medical images using Optimal Pixel Repetition (OPR). OPR converts every pixel of the input image to a 2 × 2 block to facilitate reversibility by ensuring all the pixels in a 2 × 2 block to have different values. Since a 2 × 2 block is comprised of 4-pixel elements, which could be arranged in sixteen possible ways; we generate a lookup table corresponding to sixteen possible positions of pixels. EPR hiding in each block is achieved by permuting the pixels of a block according to the four-bit word of secret data, resulting in a histogram invariant stego image. The histogram invariance improves the robustness of the proposed scheme to statistical attacks. A stego image is said to hide embedded data securely, when it provides better imperceptivity for an appreciably high payload. Thus, while using information embedding approach for securing client data on a mobile-cloud platform, high imperceptivity is a desirable feature. Experimental results show that average PSNR obtained is 42 dB for payload 1.25 bpp by our scheme, showing its effectiveness for preventing unauthorized access to client’s sensitive data.