Federated genomic & clinical query across borders — finding the other 49 patients on Earth without ever moving a single raw record
There are more than 7,000 recognized rare diseases, and roughly 72% are genetic in origin. Individually, most affect fewer than 1 in 50,000 people — some fewer than 1 in a million. A single country, even a large one, may hold only a handful of confirmed cases of any given ultra-rare disorder, scattered across disconnected hospital systems, research biobanks, and diagnostic labs that were never built to talk to each other, let alone across a border.
Statistical power in genetic disease research depends on cohort size. For a common disease like type 2 diabetes, a single national biobank of a few hundred thousand people can find robust genetic associations. For an ultra-rare disease with 50 known patients on the entire planet, no single country's healthcare system — regardless of its size or wealth — can ever assemble a cohort large enough to confirm a gene-disease link, characterize a phenotypic spectrum, or run a meaningful clinical trial.
This is the defining structural fact of rare disease medicine: the unit of analysis is not the nation, it is the world. A pediatric neurologist in Toronto and a geneticist in Cape Town may each have exactly one patient with an unclassified variant in the same gene — and unless those two records can somehow be compared, both patients remain undiagnosed indefinitely, each an isolated "n of 1" instead of a confirmed "n of 2" that could anchor a diagnosis.
Historically, the only way to compare cases across borders was informal — a clinician emailing a colleague, a case report published years after the fact, a conference hallway conversation. This worked occasionally, by luck, for the most connected specialists. It systematically failed everyone else.
IRDiRC — the International Rare Diseases Research Consortium — has set an explicit goal that all patients with a suspected rare disease reach a diagnosis within one year of specialist assessment by 2027, and that 1,000 new therapies for rare diseases exist by the same horizon. Neither target is achievable without cross-border data access at consortium scale.
A typical national or institutional rare disease dataset silo includes several layers, all locked to local access:
• Genomic layer: whole-genome or whole-exome sequences, variant call files (VCF), often with candidate variants already flagged by local geneticists • Phenotypic layer: structured clinical observations, frequently coded in Human Phenotype Ontology (HPO) terms — but sometimes still free-text physician notes • Consent layer: patient-signed permissions that are usually scoped narrowly to the originating institution or country, and rarely anticipate international sharing • Legal/regulatory layer: national health-data law (GDPR in the EU, HIPAA in the US, LGPD in Brazil, POPIA in South Africa, and dozens of others) governing what may leave the jurisdiction, and how
Each of these layers alone would be a manageable engineering problem. Together, multiplied across dozens of countries with incompatible ontologies, consent language, and legal regimes, they produce exactly what the name implies: silos. Rich, well-curated, clinically valuable — and invisible to everyone outside their own walls.
The consequence of undiscovered cross-border matches is not abstract. Rare disease patients endure what is commonly called the "diagnostic odyssey" — an average of 5 to 7 years and more than 7 clinicians before receiving a correct diagnosis, according to patient-advocacy survey data collected across the US, EU, and Australia. For a meaningful fraction of these patients, the missing piece was never a better test performed locally — it was the fact that the matching case, and the answer, already existed in another country's database, unreachable behind that country's silo wall.
A federated data-sharing network does not begin with a shared database — it begins with shared standards. Before any two institutions can usefully query each other, they must agree on how a variant is described, how a phenotype is coded, how consent is represented, and how a query itself is structured. This is the founding work of the Global Alliance for Genomics and Health (GA4GH): a technical and policy framework, not a data warehouse.
Federation inverts the traditional data-sharing model. Instead of copying data into a central repository — which triggers every jurisdiction's toughest export controls — federation keeps each dataset physically and legally in place, and instead standardizes the interface for asking questions of it.
The core architectural pieces:
• Local data node: each participating institution runs its own secured database, under its own governance, subject only to its own national law • Common data model: variants, phenotypes, and clinical metadata are mapped to shared vocabularies (HPO for phenotype, HGVS/VRS for variant representation, Mondo/Orphanet for disease terms) so a query means the same thing everywhere • API layer: a standardized query interface — most prominently the GA4GH Beacon protocol — sits in front of each local node, translating an incoming federated query into a local database lookup • Aggregator/portal: a shared front door (such as RD-Connect's GPAP, or a consortium-specific Beacon network) that fans a single researcher query out to every participating node and collects the responses
Critically, raw records never move. What moves is the query going out, and a filtered, minimal, often binary or aggregate answer coming back.
The Beacon protocol, developed under GA4GH, is deliberately minimal by design. In its simplest form, a Beacon answers a yes/no question: "Do you have any record with variant X?" No patient identifiers, no genotype context, no clinical detail — just presence or absence. This minimalism is a security feature, not a limitation: even a fully adversarial querier attempting to reconstruct a genome one query at a time is throttled by rate limits, query auditing, and (in more advanced deployments) differential-privacy noise injected into the responses.
Over time, Beacon has evolved (Beacon v2) to support richer federated queries — phenotype-variant co-occurrence, cohort-level counts bucketed to avoid re-identification, structured result sets — while preserving the founding principle: the query travels, the data does not.
RD-Connect, one of the earliest large-scale implementations of this model in Europe, connects genomic, phenotypic, and biosample registry data across dozens of European rare disease centers through exactly this kind of federated interface, feeding directly into the pan-European Solve-RD initiative for undiagnosed patients.
The Beacon network now spans hundreds of individual Beacons worldwide — from national genomics initiatives to individual hospital biobanks — all speaking the same federated query protocol, forming the connective tissue that makes GA4GH's standards actionable rather than aspirational.
For a new country or institution to join a federated rare disease consortium, it typically must:
1. Map its local data to the shared ontologies (HPO, HGVS/VRS, Mondo) — often the largest practical hurdle, requiring dedicated data curation staff 2. Deploy a Beacon-compliant (or equivalent) API endpoint in front of its local database, behind its own firewall 3. Establish a local data access committee empowered to approve incoming federated queries under national law 4. Register with the consortium's central directory so its node becomes discoverable to other members' queries
None of this requires surrendering data custody. A hospital in Nairobi or a genomics institute in Seoul remains the sole legal custodian of its patients' records throughout — it has simply made those records federably queryable.
Once the network exists, the moment of discovery looks deceptively simple from the researcher's chair: type a query, press enter, wait a few seconds, see a result. Underneath, that single action fans out to every participating node simultaneously, each of which independently computes an answer against its own local, unexposed database before returning only what the protocol allows.
A researcher investigating a novel candidate gene in an undiagnosed patient submits a structured query: a variant (e.g., a specific HGVS notation), a phenotype set (HPO terms describing the patient's clinical presentation), or both in combination.
The query does not touch a central database because no central database of raw records exists. Instead:
1. The query is validated and logged at the access portal (for audit and governance) 2. It is broadcast in parallel to every registered node's Beacon (or equivalent) endpoint 3. Each node runs the query locally, entirely inside its own infrastructure, against its own data 4. Each node applies its own local privacy policy to the result — a strict k-anonymity threshold might suppress a match if fewer than k patients share the profile 5. Only the permitted response — often just "match found" plus a minimal set of non-identifying attributes, or a contact route to the responsible local clinician — travels back to the researcher
The entire round trip typically completes in seconds, even across a network spanning dozens of countries and time zones, because each node's computation is local and small — it is only ever searching its own data, never anyone else's.
The design discipline of federated querying rests on a strict separation between signal and substance:
• What can return: a binary match/no-match, a de-identified count bucketed to prevent re-identification (e.g., "3–5 patients" rather than an exact count below a safety threshold), an anonymized contact channel that lets the querying researcher reach the responsible clinician through an approved intermediary • What never returns automatically: the raw genotype, the patient's name or identifiers, unfiltered clinical notes, or any data element that was not explicitly cleared for federated exposure by the local access committee
When a genuine match is found, the system does not hand over patient data — it hands over a path. The two clinicians, one on each end of the match, are connected through a formal, auditable, consent-respecting process (frequently modeled on RD-Connect's "matchmaking" workflow) that allows them to compare notes and, if both parties agree, pursue deeper collaborative data sharing under a dedicated data use agreement.
The MatchMaker Exchange, a related federation of case-matching services layered on top of standards like Beacon, has enabled thousands of gene-disease discoveries by connecting clinicians who each held a single undiagnosed case with an unusual variant in the same gene — cases that, alone, were statistically meaningless, but together confirmed causality.
Centralizing raw genomic and clinical data from dozens of countries into one warehouse is, in practice, close to a legal impossibility — it would require every contributing jurisdiction to permit bulk export of its most sensitive citizen data to a foreign-controlled server. The federated query model sidesteps this entirely: no export ever occurs, so no jurisdiction's data-sovereignty law is triggered by the act of participating. This is precisely why federation, not centralization, became the practical architecture for global rare disease research.
The hardest technical problem in federated rare disease research is not moving queries around — it is proving that two records match across two independently governed databases without either side ever seeing the other's raw data. A family of privacy-preserving computation techniques makes this possible, turning "trust me" into "verify cryptographically."
Rather than transmitting an actual genotype for comparison, many federated systems exchange one-way cryptographic hashes of variant representations — a fixed-length token computed from the variant's canonical description (chromosome, position, reference and alternate allele, using a standard like GA4GH's VRS). Two nodes can compare hashes and confirm an exact match without either party ever reconstructing the other's underlying variant call from the hash alone, because the hash function is intentionally irreversible.
This converts "does your database contain this variant" into "does this token equal that token" — a comparison that reveals only equality, nothing else.
Even a truthful aggregate answer can leak identity if the underlying group is too small. If a query about a rare phenotype-variant combination would return "1 matching patient" from a small national registry, that single patient may be re-identifiable by anyone who knows the local context (age range, sex, region). Federated systems defend against this with:
• k-anonymity thresholds: a result is only released if at least k individuals (commonly k=5 or higher) share the matching profile; otherwise the node returns a suppressed or bucketed response ("fewer than 5 matches") • Differential privacy: calibrated statistical noise is added to aggregate counts so that the presence or absence of any single individual in the dataset cannot be inferred from the response, even across repeated queries • Query rate limiting and audit logging: every query is logged, and unusual patterns (e.g., many narrow queries designed to triangulate one individual) can be flagged and blocked by the local access committee
These techniques trade some statistical resolution for a hard privacy guarantee — a deliberate and necessary cost given the stakes of exposing an identifiable rare disease patient's genome.
Secure multi-party computation (MPC) and homomorphic encryption (HE) push privacy-preserving matching further still: they allow a computation — such as comparing two variant sets for overlap — to be performed directly on encrypted data, so that not even the computing party (let alone the counterpart institution) ever sees the plaintext genomic information at any point in the process.
Every privacy-preserving technique introduces friction. Stricter k-anonymity thresholds suppress more true matches involving very small groups — exactly the ultra-rare cases the consortium exists to help. More aggressive differential-privacy noise makes aggregate signals murkier. This is not a flaw to be engineered away; it is an irreducible trade-off that governance bodies must set deliberately, balancing the urgency of diagnosis against the individual patient's right to privacy and the consortium's long-term trustworthiness — because a single well-publicized re-identification failure could collapse participant trust across the entire network.
The payoff of federated infrastructure arrives when matched signals from dozens of independently governed, privacy-preserving nodes accumulate into a pattern that no single country's dataset — however excellent — could ever have revealed alone: a rare disease cluster spanning continents, finally large enough to confirm causality, characterize a phenotype, and be published.
A gene-disease discovery typically requires converging evidence: multiple unrelated individuals with damaging variants in the same gene, overlapping clinical presentations, and ideally functional evidence that the variant disrupts the gene's biological role. For an ultra-rare disorder, "multiple unrelated individuals" might mean assembling patients three, five, or fifteen — from as many different countries.
Federated discovery works by letting each of those isolated single-patient cases surface a cross-border match through the query-and-privacy-preserving-confirmation pipeline described in the previous stages. As each match resolves into a formal clinician-to-clinician connection, the case count needed for statistical and clinical confidence accumulates — not inside any one country's registry, but across the consortium as a whole. The discovery belongs to the network, not to any single node.
The Solve-RD project — built on RD-Connect's federated infrastructure and spanning dozens of European rare disease centers — periodically reanalyzes pooled genomic data from thousands of previously undiagnosed patients using updated gene-disease knowledge and newly available comparison cohorts, yielding hundreds of new diagnoses that were computationally invisible when each patient's data sat alone in its country of origin.
The MatchMaker Exchange federation has repeatedly demonstrated the same principle at even wider, global scale: a clinician in one country flags a single patient with an unclassified variant in a poorly understood gene; months or years later, a matching flag appears from an entirely different continent; the connection confirms a brand-new gene-disease relationship that neither clinician, nor either country's dataset, could have established independently.
IRDiRC's stated ambition — that by 2027 all patients with a suspected rare disease reach a diagnosis within one year, and that 1,000 new rare disease therapies exist — is explicitly premised on this federated, consortium-scale model becoming the default mode of rare disease research worldwide, not a specialized exception.
Consortium-scale success depends on solving problems that are organizational and political as much as technical:
• Divergent privacy law: GDPR (EU), HIPAA (US), and dozens of other national frameworks impose different — sometimes conflicting — requirements on what may be queried, logged, or disclosed, forcing consortia to engineer to the strictest common denominator or negotiate bespoke data use agreements per jurisdiction • Data standardization debt: legacy clinical systems, especially in lower-resource settings, often lack the curation capacity to map local records into HPO, VRS, or Mondo terms, effectively excluding them from federated discoverability regardless of good intentions • Funding sustainability: federated infrastructure requires continuous investment in node maintenance, data curation staff, and governance committees — funding that rare disease research, by definition covering small patient populations with limited commercial pull, struggles to sustain long-term • Equity for lower-resource countries: without deliberate investment, federated consortia risk reproducing global health inequity in digital form — well-resourced countries' patients become discoverable and diagnosable, while patients in countries lacking sequencing infrastructure or curation capacity remain invisible to the very network built to find them
Addressing these is now treated as central, not peripheral, to IRDiRC's and GA4GH's mission — because a federation that only the wealthiest nations can join is a smaller, less powerful federation than the one ultra-rare disease patients actually need.