---
title: "Federated learning deployed in a regulator‑audited secure processing environment across multiple h"
id: "medrxiv-20-federated-learning-in-a-regulator-audited-secure-processing-environment-a-multi"
canonical_url: "https://medichelpline.com/clinical-feed/medrxiv-20-federated-learning-in-a-regulator-audited-secure-processing-environment-a-multi"
content_type: "clinical_feed_article"
specialty: "General"
source_name: "medRxiv (Clinical Preprints)"
source_url: "https://www.medrxiv.org/content/10.64898/2026.09.15.26363093v1?rss=1"
published_at: "2026-09-21T12:00:00.000Z"
evidence_level: "Verified Feed"
license: "CC-BY-NC-4.0 / Informational Use"
---
# Federated learning deployed in a regulator‑audited secure processing environment across multiple h
## Provenance & Clinical Metadata
- **Canonical URL:** https://medichelpline.com/clinical-feed/medrxiv-20-federated-learning-in-a-regulator-audited-secure-processing-environment-a-multi
- **Specialty:** [General](https://medichelpline.com/clinical-feed/general.md)
- **Primary Source:** medRxiv (Clinical Preprints)
- **Source URL:** [Original Journal Publication](https://www.medrxiv.org/content/10.64898/2026.09.15.26363093v1?rss=1)
- **Published At:** 2026-09-21T12:00:00.000Z
- **Evidence Rating:** Verified Feed
## Executive GIST (TL;DR)
- The study implemented a decentralised **swarm learning** system to enable **federated learning** across three Finnish university hospitals while keeping patient‑level data local. - Integration was performed as an extension to an existing certified **secure processing environment** (SPE) operated by Helsinki University Hospital (HUS), which required a differential regulatory security assessment under Finland's Act on the Secondary Use of Health and Social Data and Findata requirements. - The regulatory assessment examined controls for data isolation and locality, identity and access management, logging and monitoring, network security, and environment protection, and produced one high‑severity, two medium‑severity, and two low‑severity findings. - The high‑ and medium‑severity findings were remediated and verified; following remediation, an independent certification report authorised the assessed extension and the federated‑learning capability for secondary use of health data within the HUS SPE. - The swarm learning coordination layer was deployed across HUS, Turku University Hospital (TYKS), and Tampere University Hospital (TAYS), with HUS operating under the regulator‑assessed SPE and partner sites under local governance. - As a use case, federated DeepSurv survival models for acute myeloid leukaemia (**AML**) were trained using harmonised longitudinal laboratory data without transferring patient‑level records. - The swarm execution achieved 100% parameter merge success and produced traceability through infrastructure logs, container logs, and a distributed ledger recording participant registration, parameter exchanges, and model‑training lineage. - On independent test sets from all three hospitals, the swarm‑trained AML model showed stronger risk stratification and improved discrimination compared with locally trained reference models: log‑hazard ratios were higher for swarm versus local models at each site (HUS 4.32 vs 1.79; TAYS 7.20 vs 3.19; TYKS 5.90 vs 2.91). - The work emphasises a reusable governance and infrastructure model that separates system‑level certification from study‑specific assessments of data, models, parameter exchanges, and outputs, supporting operationalisation of decentralised federated learning within regulated health‑data infrastructures. - Data cannot be publicly shared because of Finnish legislation and permit conditions; access may be requested from relevant controllers subject to approvals and secure processing requirements.
## Clinical Analysis & Structured Key Points
Federated learning in a regulator-audited secure processing environment: a multi-hospital deployment study | medRxiv Skip to main content Federated learning in a regulator-audited secure processing environment: a multi-hospital deployment study Valtteri Nieminen , Hartmut Schultze , Sampo Kukkurainen , Harri J Rantala , Leena Hakkarainen , Per-Eric Gustafsson , Tuoma Hakala , Emmi Turunen , Markus Johansson , Tarja Laitinen , Dimitrios Tsallos , Kimmo Porkka , Arho Virkki , Joachim Schultze , Eric Fey doi: https://doi.org/10.64898/2026.09.15.26363093 Valtteri Nieminen 1 Helsinki University Hospital; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Hartmut Schultze 2 German Center for Neurodegenerative Diseases; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Sampo Kukkurainen 3 Tampere University Hospital; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Harri J Rantala 3 Tampere University Hospital; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Leena Hakkarainen 3 Tampere University Hospital; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Per-Eric Gustafsson 4 Turku University Hospital; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Tuoma Hakala 5 Tieto Oyj; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Emmi Turunen 6 LUT University; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Markus Johansson 7 Istekki Oy; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Tarja Laitinen 8 University of Helsinki Find this author on Google Scholar Find this author on PubMed Search for this author on this site Dimitrios Tsallos 1 Helsinki University Hospital; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Kimmo Porkka 8 University of Helsinki Find this author on Google Scholar Find this author on PubMed Search for this author on this site Arho Virkki 4 Turku University Hospital; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Joachim Schultze 2 German Center for Neurodegenerative Diseases; Find this author on Google Scholar Find this author on PubMed Search for this author on this site Eric Fey 1 Helsinki University Hospital; Find this author on Google Scholar Find this author on PubMed Search for this author on this site For correspondence: eric.fey{at}hus.fi Abstract Info/History Metrics Data/Code Preview PDF Abstract Background. Federated learning enables collaborative model development without transferring patient level data between institutions. However, translation into routine healthcare practice remains limited because deployment requires more than distributed model training. Federated infrastructures must operate within secure processing environments, satisfy governance and security requirements, support auditability, and integrate with existing regulatory workflows for secondary use of health data. Although federated learning has been demonstrated in multiple clinical applications, evidence for its deployment, assessment, and operation within regulated health-data infrastructures remains limited. Methods. We implemented a decentralised swarm learning system for federated learning and integrated it into Acamedic, a certified secure processing environment (SPE) operated by Helsinki University Hospital (HUS). Introduction of the swarm learning coordination layer constituted a material modification to the previously certified HUS SPE and triggered a differential regulatory security assessment under Finland's Act on the Secondary Use of Health and Social Data and associated Findata requirements. The assessment evaluated controls relating to data isolation and locality, identity and access management, logging and monitoring, network security, and environment protection, while establishing a governance model that separates certification of infrastructure-level controls from study specific assessment of data, models, parameter exchanges, and outputs. The swarm learning architecture was developed and deployed across the university hospitals of Helsinki, Turku, and Tampere, with HUS serving as the regulator-assessed implementation within a certified SPE and partner sites operating under local institutional governance frameworks. As an operational exemplar, we trained federated DeepSurv survival models for acute myeloid leukaemia (AML) using harmonised longitudinal laboratory data. Findings. The differential security assessment identified one high-severity, two medium-severity, and two low-severity findings. All high- and medium-severity findings were remediated and verified, after which an independent certification report was issued for the assessed extension. The resulting federated-learning capability was authorised for secondary use of health data and operationalised as a reusable extension to the HUS secure processing environment. Swarm learning was successfully executed across three university hospitals without transferring patient-level data, achieving 100% parameter merge success. Training operations were traceable through infrastructure logs, container logs, and a distributed ledger coordination layer recording participant registration, parameter exchanges, and model-training lineage. On independent test sets from all three hospitals, the swarm-trained AML model demonstrated stronger risk stratification than locally trained reference models, with consistently stronger risk separation, higher log-hazard ratios (swarm vs local: 4.32 vs 1.79 at HUS, 7.20 vs 3.19 at TAYS, and 5.90 vs 2.91 at TYKS), and improved discrimination metrics. The resulting federated-learning capability was authorised for secondary use of health data, operationalised as a reusable extension to the HUS secure processing environment, and made available for future permit approved analyses. Interpretation. This study demonstrates that federated learning can be integrated into a certified secure processing environment, subjected to regulatory assessment, and operated across independent hospitals without centralising patient level data. The principal contribution is a reusable governance and infrastructure model that separates assessment of system-level controls from study specific evaluation of data, models, parameter exchanges, and outputs. By enabling federated learning to function as an assessed infrastructure capability rather than a project-specific exception, the approach provides a practical pathway for operationalising decentralised federated learning within regulated health-data environments. The findings are directly relevant to emerging European frameworks for secondary use of health data, including secure processing environments envisioned under the European Health Data Space, whose implementation builds on many of the same governance principles evaluated in this study. Competing Interest Statement The authors have declared no competing interest. Author Declarations I confirm all relevant ethical guidelines have been followed, and any necessary IRB and/or ethics committee approvals have been obtained. Yes The details of the IRB/oversight body that provided approval or exemption for the research described are given below: IRB of Helsinki University Hospital gave ethical approval for this work. IRB of Tampere University Hospital gave ethical approval for this work. IRB of Turku University Hospital gave ethical approval for this work. I confirm that all necessary patient/participant consent has been obtained and the appropriate institutional forms have been archived, and that any patient/participant/sample identifiers included were not known to anyone (e.g., hospital staff, patients or participants themselves) outside the research group so cannot be used to identify individuals. Yes I understand that all clinical trials and any other prospective interventional studies must be registered with an ICMJE-approved registry, such as ClinicalTrials.gov. I confirm that any such study reported in the manuscript has been registered and the trial registration ID is provided (note: if posting a prospective study registered retrospectively, please provide a statement in the trial ID field explaining why the study was not registered in advance). Yes I have followed all appropriate research reporting guidelines, such as any relevant EQUATOR Network research reporting checklist(s) and other pertinent material, if applicable. Yes Data Availability The patient-level data cannot be made publicly available because they contain sensitive health information and are subject to Finnish legislation and institutional data-permit conditions. Access may be requested from the relevant data controllers and authorities, subject to applicable approvals and secure processing requirements. Copyright The copyright holder for this preprint is the author/funder, who has granted medRxiv a license to display the preprint in perpetuity. All rights reserved. No reuse allowed without permission. Back to top Previous Next Posted September 21, 2026. Download PDF Data/Code Email Thank you for your interest in spreading the word about medRxiv. NOTE: Your email address is requested solely to identify you as the sender of this article. Your Email * Your Name * Send To * Enter multiple addresses on separate lines or separate them with commas. You are going to email the following Federated learning in a regulator-audited secure processing environment: a multi-hospital deployment study Message Subject (Your Name) has forwarded a page to you from medRxiv Message Body (Your Name) thought you would like to see this page from the medRxiv website. Your Personal Message CAPTCHA This question is for testing whether or not you are a human visitor and to prevent automated spam submissions. Share Federated learning in a regulator-audited secure processing environment: a multi-hospital deployment study Valtteri Nieminen , Hartmut Schultze , Sampo Kukkurainen , Harri J Rantala , Leena Hakkarainen , Per-Eric Gustafsson , Tuoma Hakala , Emmi Turunen , Markus Johansson , Tarja Laitinen , Dimitrios Tsallos , Kimmo Porkka , Arho Virkki , Joachim Schultze , Eric Fey medRxiv 2026.09.15.26363093; doi: https://doi.org/10.64898/2026.09.15.26363093 Share This Article: Copy Citation Tools Federated learning in a regulator-audited secure processing environment: a multi-hospital deployment study Valtteri Nieminen , Hartmut Schultze , Sampo Kukkurainen , Harri J Rantala , Leena Hakkarainen , Per-Eric Gustafsson , Tuoma Hakala , Emmi Turunen , Markus Johansson , Tarja Laitinen , Dimitrios Tsallos , Kimmo Porkka , Arho Virkki , Joachim Schultze , Eric Fey medRxiv 2026.09.15.26363093; doi: https://doi.org/10.64898/2026.09.15.26363093 Citation Manager Formats BibTeX Bookends EasyBib EndNote (tagged) EndNote 8 (xml) Medlars Mendeley Papers RefWorks Tagged Ref Manager RIS Zotero Tweet Widget Facebook Like Google Plus One Subject Areas All Articles Addiction Medicine (619) Allergy and Immunology (903) Anesthesia (335) Cardiovascular Medicine (4832) Dentistry and Oral Medicine (479) Dermatology (419) Emergency Medicine (651) Endocrinology (including Diabetes Mellitus and Metabolic Disease) (1633) Epidemiology (15979) Forensic Medicine (33) Gastroenterology (1206) Genetic and Genomic Medicine (7067) Geriatric Medicine (734) Health Economics (1067) Health Informatics (5060) Health Policy (1438) Health Systems and Quality Improvement (1775) Hematology (587) HIV/AIDS (1347) Infectious Diseases (except HIV/AIDS) (16309) Intensive Care and Critical Care Medicine (1175) Medical Education (671) Medical Ethics (155) Nephrology (727) Neurology (7294) Nursing (368) Nutrition (1084) Obstetrics and Gynecology (1244) Occupational and Environmental Health (1006) Oncology (3616) Ophthalmology (1055) Orthopedics (398) Otolaryngology (458) Pain Medicine (474) Palliative Medicine (139) Pathology (709) Pediatrics (1805) Pharmacology and Therapeutics (739) Primary Care Research (768) Psychiatry and Clinical Psychology (5921) Public and Global Health (9772) Radiology and Imaging (2433) Rehabilitation Medicine and Physical Therapy (1456) Respiratory Medicine (1250) Rheumatology (643) Sexual and Reproductive Health (773) Sports Medicine (581) Surgery (782) Toxicology (107) Transplantation (305) Urology (293)
## Related Clinical Research

- [Global bibliometric analysis of Breaking Bad News research (2000–2025): trends and priorities](https://medichelpline.com/clinical-feed/medrxiv-13-tracing-the-evolution-of-research-on-breaking-bad-news-a-global-analysis-of.md)
- [Hotspotters trial process evaluation: lessons on implementing integrated proactive care for patien](https://medichelpline.com/clinical-feed/medrxiv-12-lessons-learned-from-a-trial-on-integrated-and-proactive-care-for-patients-with.md)
- [Piezo1 membrane feedback drives self-organization into finite clusters](https://medichelpline.com/clinical-feed/biorxiv-13-recursive-feedback-between-piezo1-conformation-and-membrane-mechanics-drives.md)
- [Jehovah’s Witnesses permit blood-derived products but keep ban on whole-blood transfusions](https://medichelpline.com/clinical-feed/stat-news-0-jehovah-s-witnesses-allow-blood-derived-products-but-keep-ban-on-whole-blood.md)
- [8-hour time-restricted eating yields greater weight loss but not consistent blood pressure benefits](https://medichelpline.com/clinical-feed/medical-news-today-0-16-8-intermittent-fasting-best-for-weight-loss-but-not-for-blood-pressure.md)

## Navigation
- [← Back to General Feed](https://medichelpline.com/clinical-feed/general.md)
- [← All Clinical Specialties](https://medichelpline.com/clinical-feed.md)
## Medical & Regulatory Disclaimer

> [!CAUTION]
> MedicHelpline content is structured for research, educational, and professional discovery purposes. It does not constitute individual medical advice, clinical diagnosis, or treatment recommendations.
> Always verify dosing, contraindications, and regulatory alerts against official product labeling and primary regulatory sources before clinical decision-making.