Case Studies

6.1 Cross-Border

FA can support international research collaborations where sensitive datasets are governed under different national regulatory frameworks. In healthcare and research, this challenge often arises when data is held inside Trusted Research Environments (TREs), which protect sensitive health data but make cross-institution or cross-border analysis harder because the data cannot be easily pooled. Federated analytics addresses this by enabling the same approved analysis to run locally within each TRE, while only aggregated results are shared.

Example 1: UK-US

A UK-US study involving NHS England, the US National Cancer Institute (NCI), and the UK Department for Science, Innovation and Technology (DSIT) enabled joint analysis of rare paediatric cancer data across jurisdictions.¹ Analytical queries were executed locally within each institution, with only encrypted intermediate results transmitted and securely aggregated using trusted execution environments and differential privacy safeguards. This allowed researchers to harmonise datasets, perform over 450 federated queries, and generate insights on incidence and outcomes without centralising raw data.

Example 2: SG-UK

The SG-UK cross-border collaboration, involving partners such as NRF, GovTech, A*STAR, and HDR UK, is working to establish a federation-ready network of Trusted Research Environments (TREs) to enable cross-border health data analysis without centralising raw data. Using a use-case driven approach, the collaboration develops both the governance framework and technology needed to derive cross-population insights, while ensuring that anonymised sensitive health data remains within each country’s regulatory and governance boundaries.

Deep Dive: 5 Safes-TES

The SG-UK collaboration is enabled by open-source federated tools including Five Safes TES (5S-TES)², which is a FA framework and tech stack that aligns to the Five Safes framework³, an internationally recognised governance model for secure data access.

The workflow is as follows:

1. A submission layer allows authorised users to define and submit analysis tasks for approved purposes.

2. A TRE agent acts as the bridge between the submission layer and each participating TRE, ensuring tasks are routed only to approved TREs.

3. Each TRE runs the analysis locally using a standard execution interface called the GA4GH Task Execution Service (TES)⁴, which provides a consistent way to define and execute the same analysis across different environments.

4. The analysis operates on locally standardised datasets (e.g. using models such as the OMOP Common Data Model⁵) to ensure that results are comparable across participants.

5. Outputs are passed through an egress stage, where disclosure control is applied before release, ensuring that no disclosive information leaves the secure environment.

As expected for FA, 5S-TES supports isolated algorithms only where the analysis must be capable of being broken into separate site-level computations, with the local results then recombined. 5S-TES supports analyses like counts, contingency tables, means, variance, covariance, Pearson correlation, t-tests, ANOVA, t-digest summaries, and some linear regression.

Example 3: Google Gboard

Source: https://research.google/blog/federated-analytics-collaborative-data-science-without-data-collection/

Google is expanding its use of federated methods to perform simple data science tasks, like computing rates and totals, across distributed data sources. In a traditional setup, a keyboard developer would need to upload a user’s entire typing history to a central server to identify trending words or slang (like “sus” or “mid”). However, because keyboard data is highly sensitive and can contain private messages or passwords, Google uses FA to discover these popular new words without ever seeing what any individual user types. This shifts the focus from data collection to insight collection, allowing the dictionary to stay current while maintaining a strict privacy boundary.

In this Google use case, the “multi-party” set-up consists of millions of individual user devices (the data owners) and a central coordinating server (the aggregator). While an individual user might use a specific slang term frequently, Google needs the collective input of millions to determine if that term is a widespread trend worthy of a dictionary update. By involving these decentralised parties, the system achieves a global view of language evolution while ensuring that data never leaves the local device.

6.2 System-Wide

Example: Multi-institution healthcare analytics

The NHS Federated Data Platform⁶ connects over 240 NHS organisations to support system-wide analytics within a single jurisdiction.

In this setup:

• Each organisation retains control over its data, but connects to a shared platform;
• Data is integrated and transformed into common structures to enable consistent analysis; and
• Analytics are delivered through standardised applications and dashboards, with results aggregated for system-level visibility.

This supports operational use cases such as elective recovery, patient flow, and supply chain management, with near real-time insights across the system. For example, in elective recovery use cases, each organisation contributes structured data such as waiting list metrics and capacity indicators, which are analysed through shared applications to produce aggregated views (e.g. backlog size, procedure mix, capacity gaps) without exposing unrestricted patient-level records across organisations.

This differs from the cross-border approaches where queries are executed separately at each site. Instead, organisations connect to a shared system with standardised data and tools to enable coordinated analysis.

References

Footnotes

1. UK Government Digital Service, “Using privacy-enhancing technologies to enable international data sharing.” https://gds.blog.gov.uk/2025/10/09/using-privacy-enhancing-technologies-to-enable-international-data-sharing/ ↩

2. Five Safes TES documentation. https://docs.federated-analytics.ac.uk/five_safes_tes ↩

3. The Five Safes framework is a widely used governance model for secure data access, covering safe people, projects, settings, data, and outputs. It is commonly used in Trusted Research Environments to manage disclosure risk. See: What is the Five Safes framework? - UK Data Service ↩

4. The GA4GH Task Execution Service (TES) is an open standard developed by the Global Alliance for Genomics and Health for submitting and running computational tasks across different environments. It defines a common format for describing analysis jobs, allowing the same approved analysis to run consistently across multiple secure platforms. See: https://www.ga4gh.org/product/task-execution-service-tes/ ↩

5. The OMOP Common Data Model (CDM) standardises the structure and coding of healthcare data so that analyses can be run consistently across different institutions. See: https://www.ohdsi.org/data-standardization/ ↩

6. NHS England, NHS Federated Data Platform overview. https://www.england.nhs.uk/digitaltechnology/nhs-federated-data-platform/ ↩