EPFL software to enable secure data-sharing for hospitals

MedCo was first released in 2019 as the first operational system to protect sensitive patient data so that it can be used collectively for medical research. The culmination of nearly a decade of internal research, the system was developed in the Laboratory for Data Security (LDS) in EPFL’s School of Computer and Communication Sciences (IC), in collaboration with the Lausanne University Hospital (CHUV).

After a year of intense cooperation with hospital IT and legal experts, MedCo has now been deployed across the university hospitals of Lausanne, Geneva, and Bern.

“The opportunity to query decentralized databases securely, while eliminating the possibility of identifying patients, is an important lever for accelerating university clinical research in Switzerland,” says CHUV deputy managing director Oliver Peters.

“As our ability to analyze and understand the diseases of individual patients grows, learning from experience becomes a necessary driver for improvement in patient care. MedCo enables us to gain precious insight from patients’ clinical histories,” says oncologist Petros Tsantoulis of the Geneva University Hospital (HUG).

LDS head Jean-Pierre Hubaux believes that once it is fully operational, MedCo will facilitate research across hospitals and other health-related institutions. “The ability to carry out computations on data without moving or decrypting it is crucial,” he says.

Cryptographic innovation

MedCo’s interface is designed to be used by medical professionals who are not necessarily computer science experts. Its decentralized model is based on a cryptographic principle called secure multiparty computation, which makes it possible to confidentially analyze the data at the different hospitals.

“When paired with the power of homomorphic encryption, which allows computations to be performed on encrypted data without decrypting it, the data remains protected end-to-end from both internal and external attacks,” explains LDS senior researcher Juan Troncoso-Pastoriza.

Following tests in Lausanne, Geneva and Bern, MedCo will also be deployed at the university hospitals of Basel and Zurich, as well as other hospitals in the Swiss Group for Clinical Cancer Research (SAKK).

“The implementation of MedCo at three major hospitals in Switzerland represents an important step towards analyzing ‘big data’ in medical oncology and beyond, as it provides collective data protection. Key for MedCo’s success will be to define a common language across all involved hospitals,” adds oncologist Julian Schardt of the Bern University Hospital (Inselspital).