Share Insights, Not Records
HIPAA-Compliant by Design

Scenario

A top-10 pharma company has spent 14 months recruiting patients for a Phase III oncology trial across five hospital networks—and is still at 40% enrollment. Each hospital manually screens charts against eligibility criteria, a process that takes coordinators 45 minutes per patient. Meanwhile, the trial burns $1.2M per month in fixed costs. The eligible patients exist across these networks—they are just invisible because HIPAA prevents hospitals from sharing patient-level data with pharma.

How It Works

Each hospital loads de-identified patient phenotype vectors into Placino's clean room using envelope encryption (AES-256-GCM + RSA-4096). Pharma defines trial criteria as structured queries. Placino's Private Set Intersection matches criteria against patient pools in encrypted space—no PHI ever leaves hospital infrastructure. Results return as aggregate site-level counts with k-anonymity thresholds (k=50) and differential privacy noise (epsilon=0.5), enabling enrollment allocation without identifying any individual patient.

Scenario

A pharma company must generate post-market drug effectiveness data for reimbursement negotiations with a national payer—but patient-level data is locked in fragmented health systems. Individual studies from single payers produce statistically underpowered cohorts (n=2,400), insufficient to satisfy FDA and EMA guidance for biosimilar equivalence claims. The pharma company faces either a costly $8M RCT or losing reimbursement coverage across a $500M market.

How It Works

Payer sends encrypted claims and pharmacy records with cryptographic matching IDs (no PII). Pharma imports treatment cohort definitions and outcome criteria. Placino executes federated comparative effectiveness queries using Private Set Intersection to match cohorts across payer systems, with all computations running in encrypted space. Results return as aggregate outcome statistics with differential privacy noise (epsilon=1.0) applied per treatment arm, meeting regulatory requirements for population-level evidence without exposing any individual patient record.

Scenario

A regional health system serves 1.2M patients, the insurer covers 800K—but only 280K overlap in shared records. Each organization has incomplete visibility: the health system misses out-of-network claims, the insurer misses inpatient episodes. As a result, neither can identify the full 340K-patient cohort with diabetes + hypertension who are at high risk for preventable strokes and heart attacks. Missed prevention opportunities cost the region $200M annually in emergency care.

How It Works

Health system and insurer each load encrypted, tokenized patient identities with aggregated clinical and claims features (HbA1c trends, medication adherence, comorbidity flags) into Placino's clean room. Placino applies federated analytics using encrypted computation and k-anonymity thresholds (k=100) to prevent identification of rare combinations. Cryptographic matching identifies overlapping patients without revealing individual records. Results return as risk-stratified cohorts with differential privacy noise applied, enabling both organizations to coordinate targeted preventive outreach.

Scenario

A pharma brand has spent $80M annually on DTC advertising campaigns but lacks deterministic proof of script lift. Survey-based measurement suggests only 11% of scripts come from DTC exposure—forcing the brand to cut budget. Yet the pharmacy chain, which owns patient-level prescription records and ad exposure logs, cannot share raw data due to privacy regulation. The brand faces budget cuts in a growth-stage product without real evidence of ROI.

How It Works

Pharma sends encrypted, anonymized ad exposure signals (hashed user IDs, time-windows, creative served) to Placino. Pharmacy chain sends encrypted de-identified prescription fills (hashed patient IDs, drug code, fill date) and patient demographics. Placino applies cryptographic matching and deterministic attribution using Merkle-chain audit trails to compute incremental lift—isolating the true causal effect of ad exposure on script fills with statistical confidence intervals. Results return as aggregate attribution models (per campaign, per geography) with k-anonymity protections (k=100), revealing true ROAS without exposing any individual patient or pseudonymized identity.

Scenario

A device manufacturer relies on hospital voluntary adverse event reporting for FDA post-market surveillance—but captures only 35% of actual implant complications because hospitals manually code events and submit sparse forms. A safety signal (unusual infection rate post-device revision surgery) exists in hospital EHR data but remains invisible to the manufacturer. Meanwhile, the hospital cannot share raw surgical records due to patient privacy concerns, and the manufacturer cannot legally contact patients directly. The delay in signal detection could result in regulatory action or patient harm.

How It Works

Hospital encrypts surgical outcome data (operative codes, complication flags, infection markers, revision rates) using envelope encryption (AES-256-GCM + RSA-4096) and sends to Placino with device serial numbers hashed via deterministic function. Device maker sends device serial, implant date, and model specifications, similarly encrypted. Placino performs Private Set Intersection to match devices to outcomes in encrypted space. Aggregated safety statistics (complication rates, revision rates, cohort demographics) return with k-anonymity thresholds (k=30 per cohort) and differential privacy noise (epsilon=0.8), enabling safety signal detection without identifying any patient.