Unlocking multi-institutional insights into disease progression with PEAL as a lossless, one-shot federated learning solution

Abstract

Multisite analysis of electronic health record (EHR) data presents unique opportunities for studying disease progression in real-world settings. However, privacy concerns, communication costs, and site-level heterogeneity pose significant challenges for analyzing longitudinal data. We introduce PEAL (Privacy-preserving Efficient Aggregation for Longitudinal data), a novel federated learning algorithm for fitting multi-level linear mixed-effects models with spline basis terms for nonlinear temporal trends. PEAL requires only a single-round transfer of summary statistics and produces results identical to using pooled individual participant data. Simulation studies demonstrate that PEAL accurately recovers fixed effects and variance components under realistic multi-level structures. We applied PEAL to real-world longitudinal datasets of systemic sclerosis patients from the Johns Hopkins and University of Pittsburgh Scleroderma Centers. This application shows our algorithm captures reasonable disease trajectories. Overall, PEAL provides a practical solution for distributed research networks studying rare diseases and time-evolving clinical outcomes by enabling lossless, communication-efficient, and privacy-preserving modeling.

Introduction

The increasing availability of large-scale observational clinical data, particularly electronic health records (EHRs) and administrative databases, has spurred growing interest in conducting multisite analyses within distributed research networks (DRNs) to advance biomedical and health services research ^1–3. These expansive datasets offer key advantages in terms of larger sample size, higher statistical power, greater generalizability across diverse patient populations, and the ability to uncover clinically meaningful patterns that may not be evident in smaller, single-center studies ^4,5. Leveraging these resources has facilitated investigations into rare diseases, treatment effect heterogeneity, and prediction of clinical outcomes and disease trajectories ^6,7.

As illustrated in Fig. 1, an especially valuable feature of EHR data is their longitudinal nature, capturing repeated measurements for individual patients from multiple sites over time ⁸. This temporal dimension provides opportunities to examine disease progression, treatment effectiveness, and healthcare utilization patterns in ways that cross-sectional data cannot. In particular, repeated measures are used to address time-dependent confounding when studying relationships among patient characteristics, treatment exposures, and clinical outcomes, thereby supporting more personalized and timely diagnosis and interventions ⁹.

Fig. 1. Multisite hierarchical structure of EHR data.

This diagram illustrates the nested data organization within the research network. In this three-level hierarchy, each site manages a cohort of patients and each patient contributes longitudinal records. For scleroderma patients, repeated measurements such as lung function tests (e.g., pFVC) are collected over time.

Realizing the full potential of such longitudinal EHR data often requires collaboration across institutions. This has made DRNs key to modern clinical research, enabling large-scale, multisite analyses that draw on diverse patient populations and healthcare systems ^3,10. In the meantime, collaborative analyses also introduce new challenges, including heterogeneity in populations, data structures, and coding practices, as well as strict restrictions on data sharing ^11–13. Current regulatory frameworks, such as the Health Insurance Portability and Accountability Act (HIPAA) in the US and the General Data Protection Regulation (GDPR) in the EU, establish the essential privacy and security standards ^14,15, underscoring the importance of developing privacy-preserving and communication-efficient decentralized approaches for analyses conducted within DRNs ¹⁶.

Federated learning (FL) provides a natural solution for analyzing multisite EHR data by keeping patient-level information localized at each site and only sharing model parameters or summary statistics, allowing collaborative model training and minimizing the privacy risks associated with traditional data-sharing methods ^17,18. In a typical architecture where there exists one analysis center and multiple collaborating hospitals, each site independently generates summary-level statistics using its own patient-level data. Such architecture has been increasingly adopted in clinical and healthcare settings to safeguard patient privacy. For instance, Pan et al.¹⁹ demonstrated that federated learning using multisite patient trajectory data improves the prediction of Alzheimer’s disease progression from mild cognitive impairment compared to local models. In another application, Guo et al.²⁰ developed a real-time medical data processing method that uses federated learning for continuous disease diagnosis model updates.

While FL methods overcome patient-level data-sharing constraints, they often involve extensive rounds of information exchange between local sites and the analysis center. From a statistical perspective, Louizos et al.²¹ reinterpreted the FedAvg algorithm by McMahan et al.²² as an Expectation-Maximization procedure for hierarchical latent variable models. The iterative nature of the statistical model, however, requires repeated rounds of communication between clients and the server to converge in the federated setting. On the deep learning side, Gürler and Rekik²³ proposed a federated graph neural network framework for predicting brain graph evolution trajectories, which similarly depends on extensive iterative exchanges to synchronize local and global models. Together, these examples highlight a common limitation: implementing sophisticated models in FL often incurs high computational costs and substantial communication overhead given their complexity.

Reducing human-in-the-loop efforts, site-to-site coordination, and communication overhead to an absolute minimum is an equally important challenge in real-world collaborative clinical settings²⁴. To reduce the burden of frequent, bandwidth-intensive exchanges between sites, several non-iterative and communication-efficient federated learning methods have been developed. For example, the ODAL and ODAC frameworks allow distributed estimation with only one-shot communication^25–27. However, these approaches assume homogeneity of the population between sites, which limits their applicability in the complex and heterogeneous clinical networks observed in practice^28,29. A key milestone in this line of research to account for between-site heterogeneity is the DLMM method proposed by Luo et al.³⁰. Built on the two-level linear mixed-effects modeling (LMM) framework, DLMM provides a principled solution for modeling the between-site heterogeneity via random effects. While it requires only a single round of site-level summary statistics sharing, DLMM produces estimates identical to those obtained using pooled individual participant data (IPD) across sites. Nevertheless, DLMM is structurally confined to two levels of hierarchy (patients nested within sites) and thus ignores longitudinal dependencies from repeated measures.

While temporal dynamics are central to understanding the disease progression, few FL methods have adequately addressed the complexities of such truly longitudinal EHR data. Fed-GLMM, recently proposed by Yan et al.³¹, offers an approximate solution for fitting generalized linear mixed models (GLMMs) in distributed settings. Although this method accounts for correlated data with repeated measurements, it does not explicitly model temporal structure, such as using splines, random slopes, autoregressive terms, or time-varying covariates. Explicit modeling of time is critical in the presence of non-linear or periodic trends, as it enables identification of non-stationary effects of risk factors on patient trajectories. In addition, its approximation lacks guarantees for lossless recovery of pooled-IPD estimates, which limits its reliability in high-stakes applications where statistical accuracy is important.

In real-world healthcare settings, routinely collected EHR data often exhibit a natural three-level hierarchical structure: repeated clinical observations are nested within individual patients, who are themselves clustered within healthcare sites. This multilevel structure demands statistical methods that can account for both longitudinal dependencies and heterogeneity across patients and institutions. Our motivating example draws on a real-world EHR dataset of patients with systemic sclerosis (scleroderma), a rare, chronic autoimmune disease with no known cure that requires long-term monitoring and care ³². As a heterogeneous disease, scleroderma is characterized by exaggerated fibrosis, vasculopathy, and dysregulation of the immune system. It can affect multiple organ systems, including the skin, lungs, heart, peripheral vasculature, gastrointestinal tract, kidneys, and musculoskeletal system, among others. Given the substantial heterogeneity of the disease, it is difficult to predict an individual patient’s disease course and identify optimal therapeutic strategies. However, there is great potential to improve predictive accuracy by leveraging an individual’s longitudinal data across multiple organ systems, as well as data from other patients, both within and across centers, who share similar clinical characteristics ³³.

This study utilizes data from two major prospective longitudinal cohorts: the Johns Hopkins Scleroderma Center Research Registry ³⁴, established in 1990 with over 4000 patients, and the University of Pittsburgh Scleroderma Center Databank ³⁵, a contemporaneous cohort contributing data on over 1000 patients. Together, these registries capture deep phenotypic profiles with repeated measurements across multiple organ systems, such as the skin type, percent predicted forced vital capacity, and right ventricular systolic pressure over time. These data enable capturing both within-patient disease progression and between-group variability. Given the rarity of this and other autoimmune rheumatic diseases, harnessing deeply phenotyped longitudinal data from multiple centers has great potential to accelerate rheumatic disease research and enable more precise study of patients’ risks and optimal therapeutic approaches. To analyze such multisite data while addressing data-sharing barriers, we were motivated to develop a federated learning method to leverage multisite EHR data for robust and generalizable analysis while respecting privacy regulations.

In response, we propose and validate PEAL, a federated learning framework that resolves the challenges outlined above by bridging the gap between exact cross-sectional methods and approximate longitudinal approaches. Specifically, our PEAL algorithm: (1) incorporates an integrated distributed diagnostic step that examines site-level summaries to identify data sparsity and mitigate re-identification risks prior to modeling; (2) minimizes communication overhead through a communication-efficient, one-shot protocol; (3) advances beyond approximate methods by reconstructing the exact profile likelihood for a three-level longitudinal hierarchy with flexible random effects structures; (4) introduces a privacy-preserving approach for non-linear temporal modeling via natural spline knot selection, handling irregularly sampled visits without sharing individual event times; and (5) achieves the lossless property by producing parameter estimates identical to those obtained from a gold-standard pooled IPD analysis. We evaluate the empirical performance of the proposed method through simulation studies and a study of the risk factors associated with progression of systemic sclerosis-associated interstitial lung disease, as measured by pulmonary function trajectory over time.

Results

Overview of the PEAL Framework

The PEAL (Privacy-preserving Efficient Aggregation for Longitudinal data) framework features a distributed algorithm for fitting three-level linear mixed-effects models on multisite longitudinal EHR data while preserving patient privacy and minimizing communication overhead. The architecture of a research network in our context is that one single analysis center coordinates with multiple participating sites, where patient-level information remains local and is used to generate standardized summary statistics. PEAL operates in two stages as outlined in Fig. 2:

• Stage 1: Data preprocessing and cohort diagnostics at each site.

• Stage 2: Implementing one-shot FL algorithm for model fitting and parameter estimation.

Fig. 2. Overview of the PEAL pipeline.

The process consists of two main stages for distributed learning of linear mixed models. Stage 1 focuses on exploring and preprocessing the data at local sites, and Stage 2 carries out federated estimation of parameters.

Specifically, in Stage 1, each clinical site first performs cohort extraction, data quality control, and feature construction. For cohort extraction, all sites apply the same predefined inclusion and exclusion criteria as well as the same set of covariates to extract data from their local databases. Following data extraction, quality checks and cohort diagnostics are conducted using code provided by the analysis center. For feature construction, in order to incorporate time-varying covariates into the model, each site reports site-specific histogram bin counts of time since onset (TSO) of disease-related activities, severity, or medication exposures. The bin counts are used to guide the placement of knots for the natural spline basis functions. This approach accommodates heterogeneity in visit patterns across sites without requiring access to IPD. By relying on each site’s empirical distribution of TSO, the spline basis is informed by the overall temporal trend of the trajectory, ensuring that the resulting model better captures temporal dynamics without being overly influenced by irregular or uneven visit schedules.

In Stage 2, the analysis center (or a designated coordinating site responsible for analysis) fits the multi-level linear mixed-effects model with the proposed federated learning algorithm. Each site now generates a set of summary statistics, where outcomes are demeaned, and continuous covariates are standardized, from its local longitudinal data matrices and transmits them to the analysis center. The center then performs maximum likelihood estimation (MLE) or restricted maximum likelihood (REML) estimation of fixed effects and variance components, including site- and patient-level random effects.

Importantly, PEAL achieves two key properties essential for practical federated learning: lossless and one-shot ^36,37. The “lossless" property refers to the mathematical and computational equivalence of the algorithm: despite data-sharing constraints, PEAL produces parameter estimates numerically identical to those from a gold-standard analysis where all IPD are pooled together. It is important to note that realizing this property in practice is conditional upon consistent data harmonization (identical variable definitions and preprocessing steps), correct model specification (matching design matrices for fixed and random effects across sites), and equivalent handling of missing data. The one-shot property, which is a unique derivation for linear mixed-effects models, eliminates the need for iterative rounds of communication between sites and the analysis center, thereby substantially reducing human-in-the-loop efforts from repeated coordination, data preparation, personnel training and turnover, and multiple IRB approvals ³⁸. This makes the PEAL framework far more scalable and practical for large, multi-institutional research networks.

Federated modeling of Scleroderma disease progression

We applied PEAL to a multisite longitudinal dataset derived from two major scleroderma research registries: the Johns Hopkins Scleroderma Center (JHSC) and the University of Pittsburgh Scleroderma Center (UPSC). The JHSC registry contributes 17,169 records from 2633 patients, while the UPSC databank contributes 4613 records from 1079 patients. Both registries include routinely collected continuous clinical measures, for example, the percent predicted forced vital capacity (pFVC), diffusing capacity of the lungs for carbon monoxide (pDLCO), left ventricular ejection fraction (EF), and right ventricular systolic pressure (RVSP), and have contributed extensively to our knowledge of scleroderma in prior studies ^34,35,39,40. Here, we focus on the pFVC as a key indicator of interstitial lung disease (ILD) progression, which is one of the most common causes of death in patients with systemic sclerosis ⁴¹.

Missing data were handled using a complete-case approach for the current univariate pFVC analysis. All covariates included in the models were time-invariant baseline characteristics (age at onset, gender, race, autoantibody subtype, diffuse type). Therefore, missing covariates occurred only when a variable was completely absent for a patient, rather than intermittently across visits. For pFVC, visits with missing values were removed, and PEAL reconstructs the pooled-data likelihood conditional on the observed dataset. Thus, the lossless property in this case corresponds to equivalence with a pooled complete-case fit of the same observed data; it does not by itself address bias under informative missingness.

To rigorously validate the lossless property of PEAL before deploying it in a decentralized setting, we first conducted an internal validation study using the JHSC cohort only. In this controlled scenario, we manually partitioned the cohort into three “synthetic sites” following similar racial and demographic distributions observed in existing literature ^35,42 (see details in Supplementary Table 1). Since full IPD were available for JHSC, we were able to fit both PEAL and the gold-standard pooled LMM⁴³. As shown in Fig. 3a, b, comparisons of the resulting estimates confirmed that PEAL recovered the fixed effects and variance components of random effects and residuals with numerical precision identical to the pooled analysis, thereby verifying the method’s lossless property in a heterogeneous multi-site setting.

Fig. 3. Application of PEAL to multisite scleroderma cohorts.

The panels display internal validation, cohort diagnostics, risk factors, and trajectory predictions across sites. a Lossless estimation of fixed effects. Comparison of PEAL estimates against the gold-standard pooled analysis, showing exact alignment of fixed effects (β). b Lossless estimation of variance components. Site-level and patient-level random-effects and residual standard deviations (σ) are identical under PEAL and pooled-IPD fitting. c Cohort diagnostics by site (JHSC top, UPSC bottom). Left: Age at onset distribution stratified by gender. Middle: Racial composition showing the proportion of White vs. Non-white patients. Right: Site-specific prevalence of major autoantibodies (ACA, RNAPol, Scl-70). d Estimated fixed effects. Estimated coefficients and 95% confidence intervals (CIs) for demographic and autoantibody covariates, including natural spline (ns) terms for time since onset and their interactions. e Fitted pulmonary function trajectories stratified by binary risk factors (autoantibodies, skin type, race, and gender) at JHSC. f Predicted trajectories across different ages of disease onset (20--50 years). Shaded areas represent 95% CIs.

We subsequently implemented PEAL on these two real-world registries without directly accessing IPD. Cohort diagnostics are summarized in Table 1 and Figure 3c(patient-level characteristics are provided in Supplementary Table 3), revealing distinct demographic and clinical profiles:

• JHSC represents a larger, more racially diverse cohort (76.8% White, with substantial representation of racial and ethnic minority groups). It has a female predominance consistent with the general scleroderma population (82.9% female) and a balanced autoantibody profile with comparable rates of Anti-Centromere Antibody (ACA), RNA Polymerase III autoantibody (RNAPol), and Topoisomerase I Autoantibody (Scl-70).

• UPSC represents a cohort with a higher proportion of White patients (89.1%) and a notably higher proportion of male patients (22.4%) compared to JHSC. Clinically, it shows a lower prevalence of ACA and a higher proportion of diffuse cutaneous subtype, indicating a potentially more severe disease phenotype in this sub-population.

Table 1.

Summary of cohort diagnostics by site, derived from record/visit-level observations

Variable	JHSC (N = 17,169)	UPSC (N = 4613)	Overall (N = 21,782)
Male
Mean (SD)	0.159 (0.366)	0.262 (0.440)	0.181 (0.385)
White
Mean (SD)	0.774 (0.418)	0.863 (0.344)	0.793 (0.405)
ACA
Mean (SD)	0.205 (0.404)	0.140 (0.347)	0.191 (0.393)
RNAPol III
Mean (SD)	0.188 (0.390)	0.190 (0.393)	0.188 (0.391)
Scl-70
Mean (SD)	0.278 (0.448)	0.285 (0.452)	0.279 (0.449)
Diffuse cutaneous type
Mean (SD)	0.437 (0.496)	0.462 (0.499)	0.442 (0.497)
Age at onset (years)
Mean (SD)	45.0 (13.1)	45.9 (13.0)	45.2 (13.1)
Median [Min, Max]	45.0 [4.00, 84.0]	46.0 [4.02, 80.7]	45.4 [4.00, 84.0]
pFVC (%)
Mean (SD)	82.0 (20.5)	78.1 (24.8)	81.2 (21.6)
Median [Min, Max]	82.0 [11.0, 158]	78.9 [0.06, 395]	81.9 [0.06, 395]
Years since onset
Mean (SD)	8.89 (6.91)	9.21 (6.84)	8.95 (6.90)
Median [Min, Max]	7.12 [0.01, 30.0]	7.58 [0.00, 30.0]	7.21 [0.00, 30.0]

Sample size (N) reflects the number of records with non-missing values per site.

By leveraging these two decentralized cohorts, we demonstrate PEAL’s ability to handle demographic heterogeneity typical of multi-institutional collaborations. The final combined cohort includes 3712 patients with complete longitudinal records for forced vital capacity, spanning over 30 years post-scleroderma onset.

As shown in Fig. 3c, some extent of between-site heterogeneity is observed. The age-at-onset distributions (left panel) show that both sites exhibit a peak onset between 40 and 60 years, but the UPSC cohort has a higher density of male patients across all age groups compared to JHSC. Racial composition (middle panel) confirms that JHSC contributes a larger share of non-White patients. Autoantibody prevalence (right panel) also varies, with JHSC showing a higher relative frequency of ACA compared to UPSC, where Scl-70 and RNAPol are slightly more prominent.

To implement PEAL, we first used local bin counts of TSO to construct site-shared natural spline basis functions (Supplementary Fig. 1). After computing and transmitting the site-level summary statistics (Table 2), we selected covariates based on a well-established body of literature suggesting that age at onset, race, gender, diffuse cutaneous subtype, and major autoantibody groups (ACA, Scl-70, RNA polymerase III) are among the strongest predictors of ILD progression and longitudinal lung function decline in scleroderma^39,40. These covariates also define clinically meaningful patient subgroups routinely used in risk stratification. We modeled time since disease onset using natural cubic splines because pulmonary function trajectories in systemic sclerosis frequently exhibit nonlinear patterns, particularly during the early and mid disease phases. Including a patient-level random slope for time is of direct clinical relevance: clinicians can interpret patient-specific rates of decline as indicators of rapidly progressive disease. The final model’s robustness was evaluated in a sensitivity analysis (Supplementary Table 2). This combination of fixed effects, nonlinear temporal components, and patient-level random slopes reflects both clinical interests and previously validated prognostic structures in scleroderma. Figure 3d presents the estimated fixed effects of the regression coefficients and 95% confidence intervals. ACA positivity and White race are associated with a notably higher pFVC ^34,44, while Scl-70 and diffuse skin subtype are linked with more deterioration ^45,46. Male sex also shows modest associations with accelerated decline, in line with prior findings that recognize it as a predictor of ILD progression in systemic sclerosis^47–49.

Table 2.

Summary statistics required for the three-level PEAL algorithm

Statistic	Description	Dimensions
mh	Number of patients per site	Scalar
$N_h={\sum }_i^{m_h}{n}_{hi}$	Number of total records per site	Scalar
$S_{h,X}=X_h^{\top }{X}_h$	Covariate cross-product	Px × Px
$S_{h,Xy}=X_h^{\top }{y}_h$	Covariate-response cross-product	Px × 1
$S_{h,XZ}=X_h^{\top }{Z}_h$	Covariate-random effects design cross-product	Px × Pz
$S_{h,Z}=Z_h^{\top }{Z}_h$	Random effects design cross-product	Pz × Pz
$S_{h,Zy}=Z_h^{\top }{y}_h$	Random effects-response cross-product	Pz × 1
$S_{h,y}=y_h^{\top }{y}_h$	Response sum of squares	Scalar

Each collaborating site computes and transfers these quantities to the analysis center. Together, these site-level statistics are sufficient to reconstruct the profile likelihood without sharing any individual participant data.

Estimates of variance components quantify the multilevel heterogeneity inherent in this multi-institutional network. The results reveal a substantial site-level random intercept variance (σ_Site-RI = 0.50) compared with the residual variance (σ_ϵ = 0.35), indicating significant baseline variation between centers that may be attributable to site-specific factors or differences in pulmonary function testing protocols. The inclusion of this site-level random intercept accommodates the substantial sample size imbalance between JHSC and UPSC. While the larger JHSC cohort proportionally drives the precision of the global fixed effects, the random effects structure utilizes partial pooling to preserve the unique baseline characteristics of the smaller UPSC cohort, preventing the larger site from disproportionately overriding site-specific inferences. At the patient level, heterogeneity in baseline severity is the dominant variance component, with patient-level random intercept variances ranging from 0.77 to 0.79 across sites. Notably, we observe distinct heterogeneity in disease progression rates between the two cohorts: the random slope variance for UPSC (σ_Patient−RS = 0.33) is markedly higher than that of JHSC (σ_Patient−RS = 0.22). This indicates that the UPSC cohort exhibits greater variability in individual rates of lung function decline, consistent with its clinical composition of higher-risk diffuse cutaneous and Scl-70 positive patients who often display more heterogeneous disease trajectories.

Finally, to evaluate clinical relevance and interpretability, we used PEAL to estimate longitudinal pFVC trajectories across clinically meaningful subgroups at JHSC (Fig. 3e, f). For instance, White patients with positive ACA antibodies demonstrate a slower rate of decline, while those with Scl-70 and diffuse cutaneous disease exhibit steeper declines. Male patients and those from older age groups also show more pronounced declines. These stratified predictions demonstrate PEAL’s potential to produce individualized, clinically plausible disease progression profiles, offering a valuable tool for risk stratification and decision support in decentralized research settings.

Simulation validation

We conducted a simulation study motivated by the hierarchical structure of real-world EHR data. Data are generated for three synthetic sites, each with 300–500 patients and 1–10 longitudinal records per patient. The fitted model includes six covariates (three binary, three continuous), a nonlinear spline effect for time, and both patient-level random intercepts and slopes with site-specific variance components. We provide more details of the simulation setup in Methods.

Figure 4 summarizes the estimation bias for both fixed effects and variance components across 5000 simulation replicates. In the top panel, biases for all six fixed effects are centered tightly around zero, indicating that PEAL provides essentially unbiased fixed-effect estimates regardless of covariate type. As expected, the spread of bias is slightly wider for binary covariates compared to continuous covariates.

Fig. 4. Estimation bias by parameter type.

The panels contrast performance across different covariate types and variance components. a Bias in fixed-effects estimates for binary and continous covariates: The boxplots show the distribution of estimation bias for fixed-effects parameters, with binary covariates in blue and continous covariates in tan. b Bias in variance component estimates: The boxlots show the distribution of estimation bias for variance parameters colored by site random intercepts (Site RI), patient random intercepts (Patient RI), patient random slopes (Patient RS), and residual varaince. Across 5000 simulation replicates, PEAL produces essentially unbiased fixed effect estimates and accurately recovers variance components under multi-level heterogeneity.

The bottom panel presents the bias in variance component estimates, separated into site-level random intercept (Site RI), patient-level random intercepts (Patient RI), patient-level random slopes (Patient RS) for each site, and the residual variance. Across all components, the medians are close to zero, with generally small interquartile ranges, demonstrating accurate recovery of variance structures. Similarly, patient-level slope variances for those associated with binary covariates exhibit wider dispersion than those for continuous covariates.

More importantly, in every single simulation replicate, the parameter estimates produced by PEAL were numerically identical to those obtained by fitting the standard LMM on the pooled individual-level data, which was also demonstrated in the internal validation study (Fig. 3a, b). Such a result confirms that the lossless property is consistently preserved regardless of the specific data realization, meaning that the distributed implementation introduces no approximation error relative to the centralized gold standard.

Together, these simulation results confirm that PEAL can reliably recover both fixed effects and complex variance structures in distributed, privacy-preserving settings. This robustness holds under realistic data-generating mechanisms that incorporate heterogeneous patient trajectories, site-specific variance components, and nonlinear time effects, showing PEAL’s suitability for multisite longitudinal EHR analyses.

Discussion

In this work, we introduce PEAL as a privacy-preserving, communication-efficient algorithm for federated modeling of longitudinal EHR data using three-level linear mixed models. PEAL offers several key advantages in multisite research networks. First, it achieves the two most essential properties of federated learning methods in practice: lossless and one-shot, under the assumption of standardized cohort extraction, identical covariate definitions, and data quality control across the distributed research network. These properties not only ensure statistical accuracy in estimating the parameters in a three-level linear mixed-effects model for EHR-based association study, but also account for practical considerations such as human-in-the-loop involvement and coordination, thereby providing a scalable and practically integrated solution to large-scale and privacy-constrained clinical research. Second, a distinguishing feature of PEAL is its ability to accommodate rich temporal structure in longitudinal data. By incorporating natural spline basis functions, PEAL models the nonlinear nature of disease progression. Moreover, it flexibly accounts for multi-layered heterogeneity by including random intercepts at both the site and patient levels, along with patient-level random slopes to reflect variation in disease evolution across individuals.

Applied to both internal validation analyses and a decentralized analysis by collaborating with JHSC and UPSC, PEAL not only reproduces pooled-model estimates exactly but also generates clinically coherent insights into disease progression. The results identify autoantibody-specific and demographic risk patterns consistent with established literature: ACA or anti-RNA polymerase III positivity and White race are associated with a higher baseline of pFVC trajectory, whereas Scl-70 positivity, diffuse cutaneous subtype, and male sex are associated with worse progression. Particularly, subgroup-specific predicted trajectories reveal distinct slopes of decline, illustrating PEAL’s ability to produce individualized, risk-stratified forecasts without direct access to patient-level data. These findings underscore PEAL’s potential as a scalable and privacy-preserving analytical tool for multisite research networks, enabling clinically meaningful inference and prediction while efficiently maintaining data-sharing constraints.

In our real-world application, we opt to include random slopes only for the temporal variable (time since onset) to avoid model overparameterization and instability in variance component estimation. This is an important consideration in distributed settings where sample sizes may vary substantially across sites. While our pragmatic approach balances flexibility and computational tractability, future implementations may benefit from more rigorous specification of the random effects structure. For instance, likelihood ratio tests or model comparison criteria, as described by Luo et al.³⁰ can guide the inclusion of random slopes for additional covariates based on empirical support.

Nonetheless, several limitations and opportunities for future development remain. First, although PEAL supports complex hierarchical structures and temporal modeling, it is currently designed only for analyzing a single continuous outcome. Motivated by the scleroderma dataset, where multiple biomarkers can be jointly leveraged to predict patient trajectories, extending the framework to accommodate multivariate longitudinal outcomes (e.g., pFVC and DLCO³⁹) would substantially improve its utility for a wider range of clinical applications.

Second, the lossless nature of PEAL guarantees algorithmic equivalence to a pooled-IPD analysis; it thus does not confer robustness against underlying statistical biases. If the pooled data suffer from non-random missingness, measurement error, or if the chosen model is misspecified, PEAL will exactly reproduce the biased estimates of the same LMM. For instance, missingness in long-term EHR registries is often informative. In the scleroderma application, such informative outcome missingness may introduce bias: patients with actively deteriorating lung function undergo more frequent testing, potentially leading the model to overestimate the rate of decline. Conversely, if severe patients drop out of the registries due to mortality, the complete-case cohort may be subject to survivor bias, resulting in an underestimation of true disease severity. Therefore, while PEAL solves the computational and privacy barriers of distributed modeling, ensuring statistical validity still requires rigorous data harmonization, careful model selection, and appropriate handling of structural missingness or measurement error prior to model estimation^50,51.

Additionally, in the current PEAL implementation, sites transmit summary statistics that are many-to-one functions of the underlying data and are comparable in granularity to standard descriptive tables commonly approved under institutional review board and data governance policies⁵². Stronger privacy-protection technologies can be integrated when required by a DRN, including homomorphic encryption and differential privacy methods^53,54. In practice, the appropriate level of privacy protection should be determined jointly with data partners based on the sample size, disease rarity, and regulatory requirements to ensure flexible deployment while maintaining rigorous privacy protection and statistical validity.

Future extensions of PEAL can also integrate deep learning-based personalized federated learning frameworks⁵⁵, allowing for client-specific adaptation in high-dimensional, nonlinear prediction tasks. Scaling PEAL to larger datasets with high-dimensional features may require more efficient optimization strategies or stochastic approximation techniques to reduce memory and computation burden at both local and central sites.

In rare and heterogeneous autoimmune rheumatic diseases, leveraging national and international data across multiple sites has great potential to accelerate scientific discovery of clinically relevant subgroups, precise and personalized prediction of future disease course, and the investigation of optimal therapeutic strategies. Our next step is to apply the proposed federated learning framework within rheumatology consortia, enabling large-scale, privacy-preserving, and collaborative research on rheumatic diseases. Related efforts have demonstrated the value of harnessing complex, longitudinal data for individualized care; for example, Kim et al.⁵⁶ developed a personalized visualization and analysis tool that aggregates multisystem trajectories and delivers real-time risk estimates for scleroderma patients. By leveraging diverse, real-world data sources without data sharing, our initiative builds on this vision and has the potential to transform rare disease research, accelerate biomarker discovery, and ultimately improve patient care and clinician efficiency across the country.

In summary, PEAL addresses critical methodological and practical challenges in federated analysis of longitudinal EHR data. By combining flexibility, lossless and one-shot estimation, and privacy-preserving design, it offers a robust foundation for future methodological innovations and clinical applications, and marks a significant step toward efficient, trustworthy, and large-scale analytics across heterogeneous health systems.

Methods

Model specification

We consider a three-level linear mixed-effects model, where repeated clinical measurements are nested within patients and patients are nested within healthcare sites. This framework captures both the temporal evolution of patient outcomes and the heterogeneity across sites and individuals.

The model specification is given as follows:

$$y_{hij}=\underset{\mathit{Fixed}\mathit{effects}}{\underbrace{X_{hij}^{\top }\mathit{\beta }+\underset{\mathit{smooth}\mathit{term}}{\underbrace{f({\mathit{time}}_{hij};\mathit{\gamma })}}}}+\underset{\mathit{Random}\mathit{effects}}{\underbrace{Z_{\mathit{site},hij}^{\top }{b}_h+Z_{\mathit{patient},hij}^{\top }{b}_{hi}}}+{ϵ}_{hij}.$$ 1

In this model, y_hij represents the clinical outcome measurement for the j-th visit of the i-th patient from the h-th clinical site. The vector X_hij contains P_x fixed-effect covariates such as demographic factors and autoantibody indicators, with corresponding coefficients β. The function f(⋅;γ) models the nonlinear temporal trend using a spline function, for example, a natural cubic spline, with basis coefficients γ and M specified knots at κ₁, …, κ_M.

The design matrices Z_site,hij, and Z_patient,hij correspond to the random effects at the site and patient levels, respectively. In general, these matrices can flexibly accommodate both random intercepts and random slopes. For example, if a random slope is included for a continuous covariate such as time since onset, Z_patient,hij will include a column for that covariate in addition to the intercept column. Thus, the dimension of Z_h = [Z_{site, h}, Z_{patient, h}] grows with the number of patients in site h and with the number of random effects specified in the model. The site-specific variations, which may include differences in clinical practices or regional factors, are captured by $b_h~\mathcal{N}\left(0,{\mathrm{\Sigma }}_{\mathrm{site}}\right)$, while patient-specific deviations from their site’s average are modeled by $b_{hi}~\mathcal{N}\left(0,{\mathrm{\Sigma }}_{\mathrm{patient}}\right)$.

The covariance matrices Σ_site and Σ_patient can also be flexibly specified, allowing either independent or correlated random effects at each level, depending on the application. In the Supplementary Information, we provide more detailed specifications for both the random intercept and random slope variants of LMM. For each site h with m_h patients, we combine all random effects into a single vector ${\mathbf{b}}_h^{*}={\left({\mathbf{b}}_h^{\top },{\mathbf{b}}_{h1}^{\top },\dots ,{\mathbf{b}}_{h{m}_h}^{\top }\right)}^{\top },$ which follows a multivariate normal distribution with covariance $V_h=\mathrm{blockdiag}\left({\mathrm{\Sigma }}_{\mathrm{site}},{\underbrace{{\mathrm{\Sigma }}_{\mathrm{patient}},\dots ,{\mathrm{\Sigma }}_{\mathrm{patient}}}}_{m_h}\right).$

Nonlinear temporal effect

In the federated learning setting, modeling outcome trajectories using natural spline terms for time poses a key challenge since IPD cannot be shared across sites. To address this, we adopt a data-adaptive yet privacy-preserving strategy that estimates knot locations based on the aggregated distribution of time since onset across all sites. Each site contributes its histogram through binned counts of TSO, enabling the analysis center to approximate the pooled distribution and determine knot positions without accessing raw IPD.

Accordingly, the temporal trend f(time_hij; γ) in Eq. (1) is modeled using natural cubic splines, with interior knots placed at empirical quantiles of the pooled TSO distribution. Following the standard practices for flexible spline fitting ^57,58, we place M knots at pre-specified percentiles to ensure they align with regions of high data density. This quantile-based approach allows the spline to capture complex, nonlinear temporal patterns while avoiding overfitting in sparsely observed regions ⁵⁹. While estimating quantiles from binned histograms introduces slight quantization error compared to exact individual event times, natural cubic splines are robust to minor perturbations in knot locations. For example, Supplementary Fig. 1 illustrates this process: site-level TSO histograms are first generated locally, and their aggregated counts approximate the pooled TSO distribution, from which empirical quantiles (25th, 50th, and 75th percentiles) are selected to guide knot placement for the natural spline basis.

PEAL algorithm design

PEAL features a two-stage federated algorithm for fitting three-level LMMs across distributed sites without sharing individual patient data. The key design goals are: (1) privacy-preservation through exclusive use of summary-level statistics, (2) communication efficiency by minimizing coordination and requiring only one round of message passing, and (3) lossless estimation, reproducing results identical to centralized pooled analysis.

To explore the characteristics of patients across different clinical sites, we begin with a systematic evaluation of cohorts to ensure data readiness and gain insights into site-level heterogeneity^60,61. This step is critical for validating representativeness, assessing potential imbalance and biases, and guiding model specification.

First, we examine the cohort size at each site to understand the relative availability of patient data and to ensure sufficient representation for downstream modeling. Disparities in sample sizes may reflect institutional differences in referral patterns, diagnosis practices, or data collection procedures, and can influence estimation stability in federated learning models.

Next, we explore the distribution of clinically relevant predictors. For example, we examine biomarkers by computing the prevalence of key scleroderma-related autoantibodies, including anti-Centromere, anti-topoisomerase I, and RNA polymerase III. Site-level variations in biomarker positivity may indicate differences in disease subtypes or patient selection, which are important considerations when interpreting longitudinal trajectories of pulmonary function.

We also summarize key demographic characteristics such as distributions of gender, race, and age at disease onset. Additionally, we could analyze calendar-year-specific incidence rates to understand the temporal dynamics of cohort enrollment and to assess potential shifts in diagnosis trends over time. These summaries help contextualize the cohort and evaluate generalizability.

To evaluate disease progression timelines, we focus on the time since onset of non-Raynaud’s symptoms, which reflects the duration between the disease onset and each clinical observation. We visualize the distribution of TSO using binned histograms at each site, and compute the global empirical quantiles to capture central tendencies and variability. This enables comparison of disease trajectories across sites and informs the appropriate placement of spline knots in the modeling stage.

Before analysis, all data undergo standardized processing to ensure consistency in variable encoding, scales, and time alignment across sites. We further restrict to complete cases to address missingness in key variables and outcomes.

Algorithm 1

PEAL: Privacy-preserving Efficient Aggregation for Longitudinal Data

Initialization:

for each site h ∈ {1,…,H} do

 Perform cohort diagnostics

 Construct TSO histograms with pre-specified minimum cell-count thresholds

 Share binned counts of TSO to the analysis center

end for

Analysis center to determine common natural spline knots from the empirical distribution of TSO, and send knots {κ₁,…,κ_M} to all sites

Summary Statistics Computation (One-shot Communication):

for each site h ∈ {1,…,H} do

 Construct the spline basis using selected knots

 Compute and send summary statistics to the analysis center:

$$m_h,N_h,S_{h,X},S_{h,Xy},S_{h,XZ},S_{h,Z},S_{h,Zy},S_{h,y}$$

end for

Central Aggregation:

Aggregate received summary statistics from all sites

Reconstruct the full profile log-likelihood for the three-level LMM without accessing IPD

Model Fitting:

Perform MLE or REML to obtain: 

$$\widehat{\beta },\widehat{\gamma },{\widehat{\mathrm{\Sigma }}}_{\mathrm{site}},{\widehat{\mathrm{\Sigma }}}_{\mathrm{patient}},{\widehat{\sigma }}_{ϵ}^2$$

Variance and CI Computation:

Estimate variances of $\widehat{\beta }$ and $\widehat{\gamma }$ from summary statistics for constructing CIs

Prediction:

Send fitted parameters to each site

for each site h do

 Generate subgroup/patient-level predictions

end for

Once the natural spline basis for modeling temporal trends is constructed in Stage 1, each participating site h computes a standardized set of summary statistics. These site-level summaries are derived from the design matrices for fixed effects (X_h), random effects (Z_h), and the outcome vector (y_h) for site h. Importantly, no individual patient-level data are transmitted at any point.

Specifically, the following statistics are computed and shared:

• m_h: Number of patients at site h

• $N_h={\sum }_{i=1}^{m_h}{n}_i$: Total number of records at site h

• $S_{h,X}=X_h^{\top }{X}_h$: Covariate cross-product matrix

• $S_{h,Xy}=X_h^{\top }{y}_h$: Covariate-outcome cross-product vector

• $S_{h,XZ}=X_h^{\top }{Z}_h$: Covariate-random effect design cross-product

• $S_{h,Z}=Z_h^{\top }{Z}_h$: Random effects design cross-product

• $S_{h,Zy}=Z_h^{\top }{y}_h$: Random effects-outcome cross-product

• $S_{h,y}=y_h^{\top }{y}_h$: Outcome sum of squares

These summary statistics, with their dimensions listed in Table 2, are transmitted to the central analysis server, which uses them to reconstruct the likelihood and carry out parameter estimation. The global likelihood is constructed based on the marginal model:

$$y_h~\mathcal{N}\left(X_h\mathit{\beta },{\mathrm{\Sigma }}_h\right),\mathrm{where}{\mathrm{\Sigma }}_h=Z_h{V}_h{Z}_h^{\top }+{\sigma }_{ϵ}^2{I}_{N_h}.$$ 2

The analysis center applies PEAL to compute the log-likelihood efficiently. With the forms and procedures derived in the Supplementary Information, the central server performs MLE or REML of model parameters, including fixed effects, variance components for both site- and patient-level random effects, and residual variance. The full profile log-likelihood is reconstructed without access to any IPD, preserving patient privacy.

This one-shot communication framework with pseudocode provided in Algorithm ?? ensures communication efficiency and exact recovery of pooled-IPD estimates, thus enabling statistically rigorous federated modeling of complex multi-level longitudinal data.

Simulation setting

The simulation study is designed to evaluate the performance of the proposed PEAL algorithm for estimating fixed effects and variance components in a three-level LMM framework.

We simulate data from H = 3 sites. The number of subjects per site, m_h, is drawn from a discrete uniform distribution on [300, 500], and each subject has a number of visits drawn from a discrete uniform distribution on [1, 10].

The model includes P_x = 6 covariates: three continuous covariates drawn from a standard normal distribution, $\mathcal{N}\left(0,1\right)$, and three binary covariates simulated from a Bernoulli trial with a prevalence rate of 0.3. We exclude the fixed intercept in simulations and include intercepts via random effects only. The true fixed-effects coefficient vector is set to β = (2, 4, 6, 3, 5, 7)^⊤.

The model includes three levels of variability:

• Site-level random intercept: $b_{0h}~\mathcal{N}\left(0,{\sigma }_u^2=0.25\right)$.

• Patient-level random intercepts: $b_{0hi}~\mathcal{N}\left(0,{\sigma }_{v_h}^2\right)$, with ${\sigma }_{v_h}~\mathrm{Uniform}\left(0.1,1\right)$ for each site h.

• Patient-level random slopes for the covariates: $b_{phi}~\mathcal{N}\left(\mathbf{0},{\mathbf{\Sigma }}_p\right)$ where ${\mathbf{\Sigma }}_p=\mathrm{diag}\left({\sigma }_{v_{ph}}^2,\dots ,{\sigma }_{v_{ph}}^2\right)$, with ${\sigma }_{v_{ph}}~\mathrm{Uniform}\left(0.25,0.75\right)$.

The residual for ${ϵ}_{hij}~\mathcal{N}\left(0,{\sigma }_{ϵ}^2\right)$ was set at ${\sigma }_{ϵ}^2=1$.

The outcome is generated according to:

$$y_{hij}=X_{hij}^{\top }\mathit{\beta }+b_{0h}+b_{0hi}+X_{hij}^{\top }{b}_{phi}+{ϵ}_{hij}.$$ 3

We repeat the simulation for S = 5000 times. Each simulation generates a dataset with site-patient-visit level records indexed by (h, i, j). For each dataset, we compute the summary statistics required by the PEAL algorithm and then fit the distributed linear mixed model using a BFGS-based optimizer⁶². Estimation is performed under an REML objective with a common residual variance assumed across sites. At the end of each run, we record estimates of the fixed effects $\widehat{\beta }$ and random effects $\widehat{\sigma }$ parameters (site-level, patient-level, patient-level slopes, and residual) for analysis.

Author contributions

Y.S. and J.T. conceived the study, developed the federated learning algorithm, implemented the statistical models, and drafted the manuscript. S.Z. and C.L. contributed to methodological development, provided guidance on model derivations, and study design. J.K., R.D., and A.S. curated the real-world scleroderma dataset. J.K. and A.S. further provided domain expertise and contributed to the interpretation of clinical findings. All authors reviewed the manuscript with substantive revisions and approved the final version.

Data availability

Real data for this study are not publicly available due to patient privacy.

Code availability

All simulations were implemented in R (version 4.4.0) and executed in parallel using the foreach and doParallel packages. R codes for PEAL and relevant simulation setups and results are available at https://github.com/sheny2/PEAL.

Competing interests

The authors declare no competing interests.

Supplementary information

The online version contains supplementary material available at https://doi.org/10.1038/s41746-026-02861-6.