Federated Cohort Discovery

A central orchestrator dispatches a standardized query to each participating site's local database. The query executes entirely within the institution's firewall, scanning structured clinical data—diagnosis codes, lab values, medications—without any raw data leaving the site. Only aggregate counts are returned.

• Site-level autonomy: Each institution retains full control over its data
• No data centralization: Eliminates the need for a single pooled data warehouse
• Real-time feasibility: Returns preliminary cohort counts in seconds to minutes

To prevent re-identification through small cell sizes, the system enforces a minimum aggregate count threshold—typically 10 or 11. If a query returns fewer patients than the threshold, the result is suppressed and reported as "<10" rather than revealing the exact count.

• Blurred counts: Protects against differencing attacks across multiple queries
• Configurable policies: Each site can set its own disclosure risk tolerance
• Audit logging: Every query and response is recorded for compliance review

Participating sites map their local data schemas to a shared Common Data Model (CDM) such as OMOP or i2b2. This semantic normalization ensures that a query for "HbA1c > 7.0" translates correctly across different EHR systems, lab coding conventions, and unit representations.

• OMOP: Observational Medical Outcomes Partnership standard
• i2b2: Informatics for Integrating Biology and the Bedside
• Terminology mapping: LOINC, SNOMED-CT, and RxNorm alignment

When sites must jointly compute statistics beyond simple counts—such as average age or gender distribution—secure multi-party computation (SMPC) protocols ensure no individual site's intermediate values are exposed. The central aggregator learns only the final combined result.

• Secret sharing: Each site's contribution is split into encrypted shares
• Zero-knowledge proofs: Verifies computation correctness without revealing inputs
• Differential privacy integration: Optional noise injection for formal privacy guarantees

Researchers rarely define the perfect cohort on the first attempt. Federated systems support interactive, multi-step refinement—broadening or narrowing criteria based on initial aggregate counts—without ever seeing individual-level data. Each iteration triggers a new distributed query cycle.

• Inclusion/exclusion criteria: Age ranges, diagnosis windows, medication history
• Temporal constraints: "Diagnosed within 6 months of first lab"
• Boolean logic: Complex AND/OR/NOT combinations across data domains

Cohort definitions are expressed as executable, version-controlled phenotype algorithms using standard formats like PheKB or OHDSI's ATLAS. These computable definitions ensure reproducibility—the same logic runs identically at every site, eliminating subjective interpretation of free-text inclusion criteria.

• PheKB: Curated library of validated electronic phenotype algorithms
• ATLAS: OHDSI's open-source cohort definition and analysis tool
• Version tracking: Enables audit trails for protocol amendments

A cryptographic protocol that allows a central server to compute the sum of model updates or query results from multiple clients while ensuring the server cannot inspect any individual client's contribution in plaintext. In cohort discovery, this enables a researcher to learn the total patient count across sites without any site revealing its local count. Techniques often involve secret sharing and pairwise masking to protect intermediate computations.

A mathematical framework that injects calibrated statistical noise into query results to provide a provable guarantee that the presence or absence of any single individual's record cannot be inferred. Applied to cohort discovery, DP ensures that even the aggregate count returned to a researcher does not leak membership information. The privacy budget, epsilon (ε) , quantifies the privacy loss—lower values indicate stronger protection at the cost of reduced statistical accuracy.

A federated learning paradigm where collaborating parties hold data with the same feature space but different sample spaces. This is the most common data partitioning scenario in healthcare cohort discovery, where multiple hospitals collect the same clinical variables (e.g., lab values, diagnoses) for entirely different patient populations. The query logic is distributed identically to each site, and only aggregate counts are returned.

The privacy-preserving process of identifying and linking records that correspond to the same individual across disparate, decentralized databases without revealing the individual's identity to the linking party. In cohort discovery, this is critical for accurately counting unique patients who appear at multiple institutions. Techniques include Bloom filter encoding of identifiers and secure multi-party computation to compare encrypted representations.

A data distribution characteristic where local client datasets are statistically heterogeneous and do not represent the overall population distribution. In cohort discovery, a query for 'Type 2 Diabetes patients' may return vastly different demographic profiles from a community clinic versus a tertiary referral center. Understanding site-specific distributional skew is essential for interpreting aggregate cohort counts and avoiding biased conclusions.

A hardware-enforced isolated area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside it. In cohort discovery architectures, TEEs can act as a secure intermediary that receives encrypted local counts, decrypts them within the enclave, computes the total, and releases only the final aggregate—ensuring that even the coordinating server's operating system cannot inspect intermediate values.