Privacy enforcement for distributed healthcare queries

In the healthcare industry and others, sensitive private information must be stored and shared between various organizations in the course of running their business. We have developed an architecture in which distributed data can be queried as if it resided in a single centralized database, while revealing minimal information beyond the answer to the query. In this paper we review the architecture and show how queries can be filtered to enforce user-specified privacy policies.We present a system for tracking information flow that is flexible enough to permit revealing sensitive data to those who have a need to know, while limiting the amount of useful information that can be obtained by a less-than-honest participant.