The increasing number of health-data breaches is creating a complicated environment for medical-data sharing and, consequently, for medical progress. Therefore, the development of new solutions that can reassure clinical sites by enabling privacy-preserving sharing of sensitive medical data in compliance with stringent regulations (e.g., HIPAA, GDPR) is now more urgent than ever. To address this issue, EPFL and CHUV have jointly developed the first prototype of MedCo, an open-source privacy-preserving distributed system that integrates current cohort explorers and provides strong security and privacy guarantees such as trust decentralization, end-to-end data protection, auditability and differential privacy. To achieve these guarantees, MedCo relies on sophisticated privacy-enhancing technologies such as secure multi-party computation, homomorphic encryption and result obfuscation. So far, MedCo has been tested on a simulated and controlled academic environment. Results show impressive performance. The query runtime is comparable to the ones of state-of-the-art cohort explorers (e.g., i2b2) that do not provide any protection guarantees besides basic access control.
