Federated analytics: research the data without moving the data

Picture a research question leaving a university office on a Friday afternoon: how many adults with bladder pain syndrome started this medication within a year of diagnosis, and how many stopped within six months? By Monday morning the question has visited hospital systems in five countries. It ran overnight in São Paulo, in Rotterdam, in Seoul. No record boarded a plane. No database was copied. What returns is a short table of numbers from each site.

The question traveled. The data stayed home. For most of the history of medical research, this was backwards — and the old direction is why health data privacy keeps ending up in the news.

Move the question, not the records

Federated analytics inverts the standard flow of research: instead of copying data from many sources into one central warehouse, the analysis is distributed to each source, executed where the data lives, and only results come back.

The centralized model's costs are familiar by now. Every copy of a dataset is a new attack surface, a new set of administrators, a new legal jurisdiction, and a new place where governance quietly decays. Once data leaves custody, the originating institution's promises — to patients, to ethics boards, to regulators — travel on trust alone.

Federation removes the copy. Each site keeps physical and legal custody of its records. A study arrives as a precisely specified query or analysis package; it runs locally against the site's data; what leaves is a summary — counts, rates, model coefficients. For that to work, every site's data has to be shaped the same way, which is why federation and data standards are inseparable in practice.

OHDSI proved the model at scale

This is not a thought experiment. The strongest prior art is OHDSI — Observational Health Data Sciences and Informatics — a global open-science community whose network studies have run identical analyses across data on hundreds of millions of patients without pooling any of it.

OHDSI's trick is the OMOP Common Data Model: every participating site converts its records into one standard structure with standard vocabularies. A study is then written once, as code, and shipped to every site. Each site runs it locally and contributes results — effect estimates, diagnostics, aggregate characterizations — to the shared analysis. Studies have spanned dozens of databases across continents, comparing treatments and characterizing diseases at a scale no single institution could approach, while every record stayed exactly where it started.

The lesson generalizes beyond OHDSI: federation is not a constraint researchers grudgingly accept. Write-once, run-everywhere analysis is better science — same logic, same definitions, every site — and the privacy property comes along for free.

What actually comes back

The discipline that makes federation meaningful is aggregate-only return: counts, rates, summary statistics, coefficients — never rows.

But "aggregate" has edge cases, and they are exactly where the danger concentrates:

• A count of two is barely an aggregate. Small counts are re-identification handles, the same hazard health agencies have managed for decades with small-cell suppression. A federated system needs a minimum group size enforced at the point of return, not in a style guide.
• Differencing is subtraction. Two large, individually safe aggregates can differ by one person — query A minus query B equals somebody. Defending this requires query gating and a memory of what has already been disclosed.
• Noise can harden the surface. For public-facing or high-volume statistics, differential privacy adds calibrated noise with provable bounds — a natural companion to federated counts, though no substitute for refusing tiny cohorts outright.

Aggregation, in other words, is where federation stops being an architecture diagram and becomes privacy engineering.

Borders stop data; questions get visas

Cross-border transfer is among the hardest problems in research law, and federation mostly dissolves it, because nothing person-level is transferred.

Under the GDPR, moving personal data outside the EU triggers Chapter V's transfer rules — adequacy decisions, standard contractual clauses, and the case-by-case assessments that followed the Schrems II judgment. Other jurisdictions go further and require certain health data to stay on national soil. For a decade, multinational research has limped through this terrain on paperwork, and the workarounds keep getting more brittle.

In-region execution sidesteps the problem at the root: the query runs where the data lives, under that region's law, and what crosses the border is statistics. One legal caution keeps the engineering honest — an aggregate over a handful of people can still relate to identifiable individuals, and European regulators, including the EDPB, assess identifiability by what is reasonably possible, not by what a release is called. The k floor is therefore not just a privacy nicety; it is what keeps an "aggregate" actually anonymous. Europe's coming infrastructure for secondary use of health data, the European Health Data Space, points the same direction — analysis brought to governed data under permit, rather than datasets shipped to whoever asks.

What federation does not fix

Federation solves where analysis happens, not whether it should. A query can be invasive, discriminatory, or simply unconsented while never moving a byte.

Three pieces of machinery still have to exist on top:

1. Consent. Custody is not permission. Each record's participation in each study needs a lawful, preferably explicit, basis — and revocation has to actually stop future queries from seeing the record.
2. Ethics review. A federated platform can execute an ill-conceived study as efficiently as a good one. Release should gate on approval, not assume it.
3. Audit. Distributed execution multiplies the places where something can quietly go wrong. Every query, every result, every refusal belongs on a tamper-evident, append-only trail that nobody — operator included — can edit after the fact.

How Mithras runs it

Mithras Health is built federated from the first commit. Research queries run in-region — records never leave the jurisdiction they live in — and return aggregates only. Every result must clear a hard k ≥ 5 floor: a cohort smaller than five people is not released, for any study, and the threshold is not configurable. Patients grant each study a revocable, scope-limited consent, so the cohort engine only ever considers records whose owners said yes to this question. And every query, grant, revocation, and refusal lands on the same append-only, cryptographically anchored audit trail.

Underneath, records are kept as FHIR R4 with OMOP CDM views projected for research — so a study arrives shaped the way the OHDSI world taught everyone to write it, and runs without the data ever learning what a suitcase is.

There is a quiet irony in how this field talks. For decades, "data sharing" has meant data shipping — and most of what the public fears about health research is really a fear of where the copies went. The federated answer is older than it sounds, and more reassuring: custody is the one privacy control that needs no policy behind it. What never leaves cannot be lost.