Query Federation

A query planner parses a single analytical request and fragments it into sub-queries tailored to each remote site's schema. The planner handles dialect translation, converting standard SQL or research syntax into the native query language of each target database. This abstraction layer allows researchers to write one query against a virtual common data model while the engine manages the syntactic and semantic differences of underlying PostgreSQL, SQL Server, or OMOP CDM instances.

The foundational privacy principle: queries travel to the data, not the reverse. Each sub-query executes entirely within the local institution's secure enclave. The remote database processes the logic against its full granular patient records, generating only an aggregated, de-identified intermediate result. This ensures that protected health information never leaves the originating firewall, maintaining compliance with HIPAA and GDPR while enabling multi-site analytics.

Partial results from each site are transmitted back to a central aggregation broker. This component performs statistical merging operations such as:

• Summation of patient counts for cohort discovery
• Inverse variance weighting for meta-analysis
• Contingency table merging for odds ratio calculations The broker assembles the final harmonized result set without ever accessing row-level data, often using secure aggregation protocols to cryptographically ensure individual site contributions remain opaque.

A critical preprocessing layer maps heterogeneous local data models to a unified common data model like OMOP. This involves:

• Terminology normalization: Mapping local codes (ICD-10, SNOMED CT, LOINC) to standard concepts
• Structural alignment: Transforming local table schemas to the canonical format
• Computable phenotype execution: Translating cohort definitions into site-specific executable code This ensures that a query for 'HbA1c > 7.0' retrieves semantically identical results across sites using different lab coding systems.

To prevent differencing attacks and inadvertent re-identification, the federation engine enforces strict minimum cell count thresholds (typically 5-11 patients). If any aggregated count falls below this threshold, the result is suppressed or obfuscated. Additional controls include:

• Query auditing: Logging all submitted queries for compliance review
• Rate limiting: Preventing rapid-fire queries designed to triangulate individuals
• Dynamic suppression: Automatically redacting small counts from contingency tables before return

Production federated networks operate across institutions with varying uptime and latency. The query engine implements asynchronous dispatch with configurable timeouts. If a site is unreachable or times out, the system can:

• Gracefully degrade: Compute results from available sites with a completeness flag
• Retry with backoff: Re-attempt failed sub-queries on a schedule
• Partial aggregation: Return interim results while awaiting straggler nodes This resilience is essential for operational networks like OHDSI spanning hundreds of global sites.

The software component that decomposes a single analytical query into sub-queries, executes them across multiple remote data nodes, and assembles the partial results into a final, harmonized answer. It acts as the central orchestrator in a federated architecture.

• Translates user intent into site-specific dialects
• Manages connection pooling and timeouts
• Handles type coercion and schema mapping across heterogeneous sources

A cryptographic method that allows a central server to compute the sum of model updates or statistics from multiple clients while ensuring that individual contributions remain private and unreadable. This is critical when intermediate results from a federated query could leak patient counts.

• Uses secret sharing or homomorphic encryption
• Protects against honest-but-curious aggregators
• Ensures only the final, aggregated result is revealed

A machine-executable algorithm that identifies a cohort of patients with a specific clinical condition from electronic health records. It uses structured codes like SNOMED CT and LOINC, laboratory results, and medication orders to define inclusion criteria.

• Transforms narrative text into Boolean logic
• Must be validated across sites to ensure consistent execution
• Forms the basis of a federated cohort discovery query

A computational system that statistically combines the results of independent studies to produce a single, more precise estimate of treatment effect. In a federated context, it often uses inverse variance weighting to account for site-specific sample sizes.

• Generates forest plots to visualize heterogeneity
• Applies heterogeneity assessment via I-squared statistics
• Pools odds ratios and hazard ratios without raw data

A legally binding contract that governs the terms, conditions, and permitted uses of a limited or de-identified dataset shared between institutions. It defines the query logic that can be executed and the minimum cell size for aggregated results to prevent re-identification.

• Specifies approved data elements and time windows
• Mandates audit trails for all federated queries
• Enforces suppression of small cell counts