VALORIS: One-shot and lossless vertical logistic regression for privacy-protecting multi-site health analytics - PMC Skip to main content An official website of the United States government Here's how you know Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Log in Dashboard Publications Account settings Log out Search… Search NCBI Primary site navigation Search Logged in as: Dashboard Publications Account settings Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide PERMALINK Copy As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice Sci Rep . 2026 Mar 8;16:12558. doi: 10.1038/s41598-026-41936-y Search in PMC Search in PubMed View in NLM Catalog Add to search VALORIS: One-shot and lossless vertical logistic regression for privacy-protecting multi-site health analytics Félix Camirand Lemyre Félix Camirand Lemyre 1 Groupe de recherche interdisciplinaire en informatique de la santé (GRIIS) (Mathematics), Université de Sherbrooke, Sherbrooke, Canada 2 Health Data Research Network Canada, Vancouver, Canada Find articles by Félix Camirand Lemyre 1, 2, # , Marie-Pier Domingue Marie-Pier Domingue 1 Groupe de recherche interdisciplinaire en informatique de la santé (GRIIS) (Mathematics), Université de Sherbrooke, Sherbrooke, Canada 3 Institut Imagine, Université Paris Cité, Paris, France Find articles by Marie-Pier Domingue 1, 3, # , Jean-Philippe Morissette Jean-Philippe Morissette 1 Groupe de recherche interdisciplinaire en informatique de la santé (GRIIS) (Mathematics), Université de Sherbrooke, Sherbrooke, Canada 2 Health Data Research Network Canada, Vancouver, Canada Find articles by Jean-Philippe Morissette 1, 2 , Anita Burgun Anita Burgun 3 Institut Imagine, Université Paris Cité, Paris, France 4 Department of Medical Informatics, Necker Hospital, AP-HP, Paris, France Find articles by Anita Burgun 3, 4 , Jean-François Ethier Jean-François Ethier 2 Health Data Research Network Canada, Vancouver, Canada 5 Groupe de recherche interdisciplinaire en informatique de la santé (GRIIS) (Medicine/Computer science), Université de Sherbrooke, Sherbrooke, Canada Find articles by Jean-François Ethier 2, 5, ✉ Author information Article notes Copyright and License information 1 Groupe de recherche interdisciplinaire en informatique de la santé (GRIIS) (Mathematics), Université de Sherbrooke, Sherbrooke, Canada 2 Health Data Research Network Canada, Vancouver, Canada 3 Institut Imagine, Université Paris Cité, Paris, France 4 Department of Medical Informatics, Necker Hospital, AP-HP, Paris, France 5 Groupe de recherche interdisciplinaire en informatique de la santé (GRIIS) (Medicine/Computer science), Université de Sherbrooke, Sherbrooke, Canada ✉ Corresponding author. # Contributed equally. Received 2025 Oct 28; Accepted 2026 Feb 23; Collection date 2026. © The Author(s) 2026 Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/ . PMC Copyright notice PMCID: PMC13086855 PMID: 41796162 Abstract Health analytics increasingly relies on variables held by different entities, such as clinical, laboratory, environmental, and genomic data. Due to legal, ethical, and social acceptability constraints, these vertically partitioned data often cannot be shared across organizations holding them. Conducting statistical analyses in such settings requires methods that protect privacy. We introduce VALORIS (Vertically partitioned Analytics under the LOgistic Regression model for Inference in Statistics), a novel method that enables lossless statistical inference (equivalent to the pooled analyses) under a logistic regression model without disclosing any individual-level data–including the outcome variable. VALORIS is a practical, one-shot algorithm that requires no third-party coordinator. The privacy-preserving properties of VALORIS were mathematically assessed, and a privacy-aware setting-dependent framework was provided to ensure individual-data privacy. We demonstrate the accuracy and feasibility of VALORIS through the investigation of potential factors associated with kidney failure among pediatric patients with chronic kidney disease using real health data from Necker-Enfants Malades Hospital. We further validate the proposed algorithm on a larger scale with a reproducible application using the MIMIC-IV database. Subject terms: Computational biology and bioinformatics, Health care, Mathematics and computing, Medical research Introduction Addressing the multidimensional nature of today’s pressing challenges in health sciences increasingly requires statistical analyses that integrate diverse, complementary data types–ranging from clinical, genomic, and laboratory measures to socioeconomic or environmental data. Such data are typically distributed across different organizations, where legal, ethical, social, or commercial constraints often preclude their pooling within a single organization. This fragmentation gives rise to a vertical partitioning, with each data source holding distinct types of information about the same observations. Critically, the constraints often go beyond restricting direct data transfers, and encompass any exchange of information that could enable individual-level data to be retrieved. Methodologies that enable statistical analyses by coordinating computations across collaborating data-holding organizations, referred to as nodes, without requiring individual-level data to leave their original environments are commonly grouped under the umbrella of distributed statistical analytics. The Health Data Research Network Canada (HDRN), mandated with supporting large-scale collaborative projects involving health data from multiple nodes, has launched a dedicated work stream on distributed analysis to guide the application of distributed procedures in projects seeking this support. However, three criteria must be considered before any procedure can be endorsed. The first and non-negotiable criterion is that the approach ensures privacy protection–specifically, it entails not only to avoid sharing raw data outside the data nodes, but also to provide formal confidentiality guarantees against reverse-engineering. Alongside privacy, practical feasibility is also essential: the approach should be communication-efficient, recognizing that many data partners operate with limited time and resources. This need for simplicity is particularly important when some partners require human review of all outgoing numerical outputs. A further criterion concerns comparability of results to those obtained in standard centralized settings. The gold standard is to produce results equivalent to those obtained under a centralized (pooled) analysis, meaning that the final outputs of the method can be made arbitrarily close to those of a centralized analysis through a suitable implementation. When this property holds, the method is said to be lossless . This comparability criterion is essential to build trust among users accustomed to centralized approaches. Among existing vertical regression-based approaches that allow statistical inference–parameter estimation and corresponding standard errors, enabling the computation of p -values and confidence intervals (CIs), covered from various angles in literature 1 – 5 , to the best of our knowledge, the only methods that comply with the above-mentioned HDRN criteria are those for the linear model 3 , 6 , 7 . By contrast, no method currently achieves this for logistic regression, despite its central role in health analytics. To address this gap, we focus on parameter estimation and standard error computation for standard logistic regression to support HDRN needs and beyond. To our knowledge, only one method has been proposed for logistic regression in a vertical setting that does not require raw data to leave its original environment 8 , 9 . Although standard errors, CIs, and hypothesis testing are not explicitly addressed, the procedure can be extended with minor modifications. Yet, as acknowledged by the original authors and highlighted in a subsequent review 10 , the method inherently involves a large number of communication rounds and leaves unresolved concerns about potential data leakage. As far as we are aware, the only other method addressing these inference tasks and producing results comparable to classical pooled maximum likelihood analyses is the VERTIGO algorithm 11 , together with its extension VERTIGO-CI 12 , applied in recent work 13 . However, this approach requires sharing the outcome variable–local raw data–with every participating node, which is inherently undesirable from a privacy standpoint. Moreover, in prior work, we showed that in many practical settings, running VERTIGO or VERTIGO-CI renders the raw covariate data reconstructible from the disclosed quantities 14 . These findings highlight that the distributed nature of an algorithm does not, on its own, ensure privacy protection, as has also been previously reported 15 , and they underscore the importance of thoroughly assessing the risk that participating parties may reconstruct individual-level data from exchanged quantities in distributed settings. Taking this into account, the aim of this work is to introduce a novel one-shot, lossless approach for estimating parameters and their standard errors in standard logistic regression with vertically partitioned data. We present the privacy-aware algorithm VALORIS–Vertically partitioned Analytics under the LOgistic Regression model for Inference in Statistics–which avoids sharing any individual-level data, including the response vector, and operates through a single round of communication. The vertical setting considered for our proposed method is illustrated for the case of three data nodes in Fig. 1 . The covariate data matrix is partitioned across distinct covariate-nodes . Covariate-node k holds a matrix containing the values of its covariates across all n observations, distinct from those stored at other nodes. The response vector is stored at the response-node , and is not shared with the other nodes. Response-node and covariate-node are not mutually exclusive roles, such that a data-node can hold both the response and covariates. We assume throughout that datasets are aligned across partitions and that this alignment corresponds to the structure of , i.e., Individual 1 appears in row 1 of all partitions and in the first entry of , and so forth. Fig. 1. Open in a new tab Centralized vs Vertically partitioned data settings for the case of two covariate-nodes. Our proposed algorithm VALORIS relies on a single back-and-forth exchange of intermediate numerical outputs between the covariate-nodes and the response-node, with the covariate-nodes disclosing only their local Gram matrices. The lossless property relative to parameter estimation is achieved by leveraging the dual formulation of a ridge-penalized log-likelihood, which, under suitable and commonly satisfied assumptions, provides an approximation to the standard log-likelihood whose approximation error can be made arbitrarily small by selecting a sufficiently small penalty parameter . The lossless property with respect to standard error estimates is achieved through the introduction of an additional parameter , which enables the use of a matrix-inversion identity to approximate the target non-penalized standard errors with arbitrarily small approximation error as both and are taken arbitrarily close to 0. The intermediate numerical outputs sent from the response-node to the covariate-nodes, enabling them to compute the final estimates for their respective variables, were carefully chosen to protect the confidentiality of the response vector by exploiting structural properties of the matrices involved. The methodological approach and communication workflow associated with VALORIS are summarized in Fig. 2 . Fig. 2. Open in a new tab Overview of VALORIS: Vertically partitioned Analytics under the LOgistic Regression model for Inference in Statistics. Details regarding the intermediate numerical outputs exchanged are provided in Methods - Detailed steps of the VALORIS algorithm . To demonstrate the feasibility and accuracy of our approach, we present a clinical case study that investigates potential factors associated with kidney failure in pediatric patients with chronic kidney disease (CKD), using de-identified clinical and laboratory structured data from Necker-Enfants Malades Hospital. This analysis extends previous efforts aimed at improving the diagnosis and treatment of renal ciliopathy patients 16 . To validate our method on a larger scale, we provide a reproducible example using the MIMIC-IV database 17 . This application illustrates both the lossless property of the algorithm and its compatibility with larger datasets. To ensure accessibility of our approach, we also made available a third example through a publicly accessible online repository, featuring a synthetic dataset we created along with the accompanying R code for its analysis 18 . To ensure privacy protection, we mathematically assessed the risk that a participating party could reconstruct individual-level data through the proposed procedure by analyzing the equations that could be formed from the quantities available at a given party, where the unknowns correspond to the individual entries of a node’s data matrix, and so while taking into account the nature of the covariates (binary vs continuous). Results VALORIS to identify characteristics associated with kidney failure among patients at Necker-Enfants Malades Hospital We first demonstrate the utility and accuracy of VALORIS through the investigation of potential associations between kidney failure within two years of baseline and various characteristics in a cohort of children with CKD. This investigation is part of an initiative to better understand this condition among pediatric patients. To guide our analysis, we drew on a study that proposed two models to predict kidney failure in adults with CKD: a model with four baseline covariates, and a model that included four additional serum measurements 19 , 20 . The cohort included pediatric patients from Necker-Enfants Malades Hospital (Paris, France) with potential CKD stage 3 or 4 at baseline and complete data ( ). Baseline covariates and serum measurement are generated by distinct systems, creating a vertical partition across two nodes: one with the binary outcome kidney failure at two years after baseline and the covariates age , sex , estimated glomerular filtration rate (eGFR) and urine albumin-creatinine ratio (uACR) ; the other containing serum measurements. A logistic regression model was assumed for the data and the VALORIS algorithm could therefore be applied. Additional details regarding the parameters setting for VALORIS are provided in Methods - Detailed steps of the VALORIS algorithm . To proceed, VALORIS was implemented in R 21 and implementation is available through the link in Supplementary Notes. The results of the analysis are provided in Fig. 3 . They were computed in the vertically partitioned setting using VALORIS, and then compared with those obtained from a non-penalized logistic regression in a centralized setting performed using the glm function from the stats package in R (version 4.4.1) 21 . Fig. 3. Open in a new tab Logistic regression model with kidney failure at two years after baseline as outcome - Vertical partition vs Centralized setting. Detailed values for estimates and standards errors are available in Supplementary Table S4 . The largest absolute difference observed between VALORIS and the centralized analysis among all parameter estimates and standard errors was . The mean absolute difference was . It is possible to further reduce this difference by decreasing the values of the parameters and used in the implementation of the algorithm (see Methods - Detailed steps of the VALORIS algorithm ), which may require computations to be carried out at higher numerical precision. VALORIS to explore associations with death among MIMIC-IV database Building on the previous section, which established the feasibility and numerical accuracy of VALORIS, we next illustrate its applicability in settings with larger sample sizes and a greater number of covariate-nodes. To this end, we provide a reproducible example using real health data from the MIMIC-IV database 17 , available upon completion of mandatory training, where VALORIS is applied to a larger sample with an increased number of covariate-nodes. A total of 11 covariates and one outcome partitioned across three modules treated as distinct data nodes were selected. The Hospitalization (HOSP) module was assigned the outcome variable death and four covariates. The Emergency Department (ED) and Intensive Care Unit (ICU) modules served as additional covariate-nodes, contributing four and three covariates, respectively. Only complete-case observations were retained, resulting in a sample size of . The results of the analysis using the VALORIS approach are presented in Fig. 4 and compared with those from the centralized analysis using again the glm function from the stats package in R (version 4.4.1). Fig. 4. Open in a new tab Logistic regression model with MIMIC-IV database and death as outcome - Vertical partition vs Centralized setting. In this application, the mean absolute difference accross all coefficients and standard errors between VALORIS and the centralized setting was , with the largest absolute difference being . In line with the previous section, these differences could be further reduced by adjusting the parameters and , which may require computations to be carried out at higher numerical precision. The detailed values for all estimates and standard errors are available in Supplementary Table S5 . Readily executable example of VALORIS - Synthetic data To offer a readily available application of VALORIS, we generated a synthetic dataset and added it to the GitHub repository 18 . Therein, an example with sample size involving two covariate-nodes respectively holding 3 and 6 covariates can be fully executed, and allows to directly compare the outputs obtained from the application of VALORIS and the centralized analysis with the glm function in R. Privacy-preserving properties of VALORIS In the literature, a distributed algorithm is often qualified as privacy-preserving if it avoids the direct transmission of individual-level data (see e.g. Duan et al. 22 stating “The algorithms are privacy-preserving in the sense that patient-level data are not required to be transferred across sites”). However, this level of privacy protection–referred to as Privacy Level I and satisfied by VALORIS–does not suffice to comply with the privacy requirements from organizations such as Necker-Enfants Malades Hospital and HDRN, where, for an algorithm to be considered privacy-preserving, the outgoing information should not allow any participating party to retrieve individual-level data whether it is done directly or using reverse-engineering. We therefore introduce Privacy Level II, which requires that individual-level data cannot be uniquely recovered from the quantities exchanged or disclosed during the execution of the approach. Specifically, when satisfied, this definition implies that for every entry in the original dataset, there exists at least one admissible candidate dataset , consistent with the disclosed quantities, that differs at that entry. Admissible candidate datasets are defined as datasets that (a) are consistent with all exchanged and disclosed quantities available to any party that could, at a given time, attempt to reconstruct the original dataset, and (b) respect the nature of each variable (e.g., binary or continuous). For assessing compliance with Privacy Level II, we assumed that the algorithm is executed as specified and that it is run in an environment without access to external information (additional scenarios are considered and discussed in detail in Supplementary Methods - Conservative Scenario ). This corresponds to the honest-but-curious adversary setting as defined in the privacy-preserving data mining literature 23 . Our assessment further relied on assumptions that are typically met in practice, including the participation of at least two covariate-nodes–one of which may be co-located with the response-node–in the analysis (see Methods - Methodology for assessing privacy-preserving properties ). We first examined the risk that the response-node could reconstruct a covariate-node’s data from its shared Gram matrix, derived from locally centered and scaled data, and found that running VALORIS achieves Privacy Level II regardless of the number or nature of covariates (see Methods - Methodology for assessing privacy-preserving properties for details). Second, verification that the sharing of intermediate quantities from the response-node to the covariate-nodes complies with Privacy Level II is sample-dependent. Under the assumption that at least one continuous covariate is held outside a potential adversarial covariate-node –an assumption automatically satisfied if each covariate-node holds at least one continuous covariate, or if the response-node itself holds covariate data with at least one continuous covariate–, this compliance can be ensured by requiring the response-node to solve a set of feasible-point problems before transmitting any information. This can be addressed using linear programming (see Supplementary Methods - Privacy-preserving properties - Privacy assessment for the response vector ). An implementation of the resulting verification criterion is available through Supplementary Notes. For all presented applications (Necker-Enfants Malades Hospital data, MIMIC-IV data and simulated data), the empirical criterion was run at the response-node for all covariate-nodes not co-located at the response-node. The criterion was satisfied in all cases. Third, the overall risk that a party with access to the disclosed parameter estimates, standard errors, or two-tailed p -values (after the algorithm has been fully executed) could retrieve a covariate-node’s individual-level data is not specific to VALORIS; it arises in most vertically partitioned analyses when final results are released. Under the assumptions described in Methods - Methodology for assessing privacy-preserving properties , including that at least one continuous covariate is held at a covariate-node not co-located with the response-node, we demonstrated that the response-node does not possess sufficient information to uniquely reconstruct the underlying data, and that Privacy Level II is ensured regardless of which estimates or standard errors are disclosed. Discussion Our new algorithm, VALORIS, enables lossless estimation of parameters and their standard errors in logistic regression models with vertically partitioned data. It does not require sharing the response vector across all parties and it explicitly provides transparency on the risk of reconstructing individual-level information through reverse-engineering. The one-shot communication workflow of VALORIS greatly facilitates the mathematical assessment of its privacy properties, since only a small number of shared quantities need to be examined. This property also makes the method well suited to settings where data nodes must manually review exchanged quantities, and it supports practical deployment regardless of whether an inter-node infrastructure is in place. In contrast, vertically partitioned methods often rely on iterative secure matrix operations or encryption schemes, which impose a substantial communication burden and hinder real-world applicability. VALORIS addresses these limitations by offering a solution that is both practical and feasible. The efficient communication workflow of VALORIS does not compromise accuracy and statistical equivalence to the centralized setting. The results in Fig. 3 and Fig. 4 show that the estimates and standard errors–or equivalently, the CIs–are nearly identical between the vertical and centralized settings. These findings highlight the accuracy of VALORIS relative to the centralized benchmark. The CKD application serves as a compelling proof of concept for analysis with vertically partitioned data. It motivates conducting further investigation into factors associated with kidney failure in pediatric cohorts, particularly by incorporating additional covariates distributed across different entities. Future distributed analyses that integrate genomic data from national cohorts with clinical data from hospital information systems could help identify renal ciliopathy cases among CKD patients, thereby improving understanding of condition-specific risk factors and supporting targeted interventions. In many settings, including projects we anticipate undertaking, covariate-nodes will place sufficient trust in the response-node to assume that the algorithm is executed as specified. In real-world collaborations, such expectations can also be formalized in agreements between participating data nodes. In such settings, different sets of numerical results (parameter estimates, standard errors, p -values) can be publicly disclosed while ensuring that no reverse-engineering process enables the retrieval of individual-level data. For completeness, we also examined in Supplementary Methods - Conservative scenario which results remain disclosable under Privacy Level II in more adversarial settings, across multiple scenarios varying in the nature and number of covariates. Our analysis enables covariate-nodes to make informed decisions about which quantities to disclose, weighing the associated privacy risks against the assumptions they are prepared to accept. This privacy awareness by design distinguishes our method from earlier approaches for statistical analyses under the logistic regression model with vertically partitioned data. The privacy check underlying Privacy Level II for the response vector plays a central role in the privacy assessment but can incur a non-negligible computational overhead in large-scale settings (see Supplementary Methods - Privacy-preserving properties - Privacy assessment for the response vector ). While this check is performed only once at the response-node, its runtime increases with the sample size, and depends on the computational environment and solver used, which should be considered when deploying the method in a practical setting. If, however, the privacy criterion fails in its current implementation, meaning that the verification procedure does not identify the admissible candidates required to achieve Privacy Level II, alternative solvers may be used. If the criterion remains inconclusive and such protection of the response individual-level data cannot be formally established, the response-node may decide whether to proceed with the analysis in the absence of Privacy Level II guarantees. As for the predictor-nodes, whether an analysis can proceed in such cases may depend on institutional and regulatory constraints, including data sensitivity and organizational privacy obligations. Our privacy assessment is intentionally conservative and focuses on establishing sufficient conditions for non-unique reconstruction of individual-level data from the available quantities. When these conditions cannot be verified–such as in settings involving all-binary covariates–this should be interpreted as the absence of a formal guarantee rather than as evidence that reconstruction is uniquely determined; moreover, our analysis does not address computational considerations that may further limit the practical feasibility of reconstruction nor what specific individual-level data may be at risk. Further work could explore privacy assessment strategies tailored to challenging settings such as all-binary covariates, where existing sufficient conditions may be overly conservative. It remains possible that external information about a dataset could be known or accessible from outside sources. While this lies beyond the scope of the present work, it could be examined in specific applications–for example, in scenarios where the response-node has access to covariate means. In situations where such privacy investigations are judged insufficient, differential privacy has been proposed as an additional layer of protection. However, applying differential privacy may adversely affect the accuracy of analytical results 24 , warranting further work beyond the scope of this paper. The other stream of work is to keep theoretically investigating the level of privacy achieved by distributed methods, in the hope of being able to achieve the objectives without modifying the raw data, nor compromising the results accuracy. It might well be possible, at least for the majority of situations encountered in real health studies. The work presented in this paper can be extended in several directions, some of which are already under investigation by our team. One important avenue is to move beyond complete-case analyses by incorporating strategies for handling missing data. Another is to adapt the structure of the algorithm to other models in vertical settings. Methods Background on standard logistic regression The statistical framework considered in our work is described as follows. Under the logistic regression model, the conditional distribution of given is given, for , as 1 where and respectively denote the true (but unknown) intercept and covariate parameters (see Supplementary Tables S1 , S2 and S3 for detailed notation glossaries). We aim to derive estimates, CIs and/or p -values associated with those unknown parameters, using a vertically partitioned sample of n independent realizations . When the data are centralized to a single data node, of the logistic regression model defined in ( 1 ) are typically estimated by solving the following log-likelihood maximization problem: 2 The solutions of the latter problem, called the maximum likelihood estimates, are generally found using a Newton-Raphson algorithm or a variant of it. The variance-covariance matrix of the maximum likelihood estimates can be estimated by the inverse of the observed Fisher information matrix, defined as 3 Standard errors of parameter estimates are computed upon extracting the diagonal entries of , taking the square-root and multiplying it by . Related works In the literature, computing and their standard errors in a vertically partitioned setting has been addressed in 8 , 9 , using an approach based on “secure sums” and “secure matrix product” algorithms. As mentioned in the introduction, this approach involves a high volume of communication between nodes and does not eliminate privacy risks, making it unsuitable for our intended applications. Our approach is different, and approximates by solving a penalized version of ( 2 ), whose dual formulation enables computation in a vertically partitioned setting using a single round of communication. The penalty parameter is chosen to be sufficiently small so that the resulting estimates remain statistically equivalent to . Dual optimization for logistic regression with vertically partitioned data has previously been used in the VERTIGO algorithm 11 and in the paper from our group revisiting the VERTIGO algorithm 14 , in the context of ridge regression (focusing on point estimates without CIs). The related VERTIGO-CI algorithm 12 also uses this approach for logistic regression with CIs, also relying on a small penalty parameter as we do in this paper. However, aside from the fact that, as noted in the introduction, their approach allows for reverse-engineering of covariate-nodes data, the penalized version of ( 2 ) considered in that work differs from ours, and their methodology lacks the theoretical justification that we provide in Supplementary Methods for appropriately choosing . In contrast to existing approaches based on dual optimization, our method does not require sharing the response vector across data nodes. Our procedure for enabling covariate-nodes to estimate their covariate-related parameters and compute their corresponding standard errors is therefore fundamentally different from all previously proposed methods. It is worth mentioning that solving an approximation to the likelihood function in ( 2 ) from vertically partitioned data has been previously considered 25 , using an approach that does not rely on dual optimization, but instead employs an approximation to the sigmoid function combined with a series of additive secret-sharing operations. However, as previously noted 11 , this method entails high computational complexity and requires numerous communication rounds, which may be impractical for our intended real-world applications. Detailed steps of the VALORIS algorithm Our algorithm VALORIS begins by requiring every covariate-node k to construct a centered and scaled version of the matrix, denoted by . Every covariate-node then computes its local Gram matrix and sends the obtained quantity to the response-node. Once the local Gram matrices have been received, the response-node numerically and locally solves the dual minimization problem given by 4 and obtains the dual estimates. The response-node subsequently sends to every covariate-node two node-specific intermediate quantities. The first intermediate quantity allows each covariate-node to solve a linear system of equations and retrieve the numerical estimates , corresponding to the components of associated with the covariates stored at that node. The second quantity allows for the local computation of associated standard errors without disclosing the response vector. The full VALORIS algorithm is stated in Algorithm 1. Algorithm 1. Open in a new tab VALORIS: Vertically partitioned analytics under the lOgistic regression model for inference in statistics. To solve ( 4 ), since the dual parameter is restricted to the domain , our implementation employs the Two-Metric Projected Newton method 26 , 27 . The algorithm also takes as input a user-defined tolerance parameter , which defines the stopping criterion for the dual optimization procedure and ensures an upper bound on the difference between the numerical and the exact solutions (see Methods - Methodology for the dual optimization program and stopping criterion in VALORIS ). Regarding parameters and , we experienced good numerical results with the choice and across various sample sizes, such that these values were set as default. Decreasing their values towards zero will narrow the difference between resulting estimates and their centralized counterpart, although this may require computations to be carried out at higher numerical precision. A sensitivity analysis with respect to the parameters , and was conducted, along with an illustrative case of strong response imbalance (2% of responses with ). The corresponding results, reported in Supplementary Tables S7 to S10 , illustrate that for each of these parameters, there exists a range of values near the defaults used in our implementation for which the resulting approximation errors are comparable in magnitude to those obtained from the default settings, whereas choosing much smaller values for these parameters may adversely affect the behaviour of our implementation of the algorithm. Additionally, selected key implementation details for the VALORIS algorithm used in our implementation 18 are provided in Supplementary Methods - Implementation details and computational considerations of the VALORIS algorithm , which also describe how the computational cost associated with our implementation scales with the sample size n , the number of sites K , and the number of covariates p . We used to denote the (approximate) numerical solution to ( 4 ) and we used a tilde to denote quantities computed from –such as , , , , and . In the following Methods sections, we adopt a different notation to refer to the exact solution of ( 4 ), which will be denoted by , and we use a hat to indicate quantities derived from it (e.g., , , , , and ). We make this distinction to separate numerical approximations from theoretical quantities used in theoretical analyses, and to explicitly define and track the approximation error. Methodology for computing parameter estimates in VALORIS To estimate in our vertically partitioned setting, we consider for the following ridge-penalized logistic regression problem 5 We denote , and we recall that and represent the mean and standard deviation of the j th column in , that is, The vector denotes the centered and scaled covariates for observation i , with entries . It is shown in Supplementary Methods - Equivalence to the standard non-penalized log-likelihood and computation of standard errors that, under suitable and commonly satisfied assumptions, the absolute difference between and the standard maximum likelihood estimator can be made arbitrarily small by choosing the penalty parameter sufficiently small. Equivalently, the precision of the proposed distributed estimator relative to the target centralized estimator can be made arbitrarily high as . The method therefore satisfies the lossless property for parameter estimation with respect to standard non-penalized logistic regression. Recall defined in ( 4 ), which represents the dual problem to the maximization problem in ( 5 ). For any , the solution can be computed as 6 where is the unique minimizer of over (see Supplementary Methods - Details for the derivation of the dual optimization problem ). As can be seen from the expression of , it depends on the covariate data only through , where denotes the local Gram matrices. To solve ( 4 ) in our vertically partitioned setting, each covariate-node is required to compute and send the matrix to the response-node. The response-node can then solve the minimization problem on its own and obtain (see details in Methods - Methodology for the dual optimization program and stopping criterion in VALORIS ), as similarly done in previous work that required the response vector to be shared to all nodes 11 , 14 . To enable each covariate-node to compute , where denotes the components of corresponding to the covariates stored at node k , and so without access to the individual response values, we require the response-node to send a distinct vector to each covariate-node which allows to construct a system of equations whose unique solution is . Noting from expressing in a vector-matrix notation that it follows that satisfies 7 If has full column rank, it follows that is the unique solution of the system of equations Methodology for computing standard errors of parameter estimates in VALORIS In our vertically partitioned setting, the observed Fisher information matrix defined in ( 3 ) cannot be directly computed. Alternatively, we show in Supplementary Methods - Equivalence to the standard non-penalized log-likelihood and computation of standard errors that, under the assumption that is chosen to be sufficiently small, it holds for that is asymptotically equivalent to , with where is a diagonal matrix whose diagonal entries satisfy Therefore, when is small, the standard error of each component j of can be consistently estimated using and the diagonal entry of . To obtain , our approach builds on the Woodbury matrix identity 28 . This result states that, given a invertible matrix , a invertible matrix , and matrices and , if is invertible, we have For any , and letting denote the identity matrix, the Woodbury matrix identity allows to express as 8 The parameter controls the accuracy of the approximation: as , converges to , allowing the approximation error to be made arbitrarily small as is also taken sufficiently small, in accordance with the lossless property. In practice, the choice of may also be influenced by numerical considerations, as excessively small values can lead to instability at finite precision. The diagonal entries of can be extracted from the terms of the form . As the matrix can be entirely computed at the response-node, the latter computes and sends this quantity to each covariate-node k to allow them to obtain the diagonal entries of corresponding to their covariate data by computing the diagonal entries of . In addition, we note that, for any matrix in the null-space of (i.e. such that ), it holds that . The quantity can be generated at the response-node because the null-space of is the null-space of 29 . Although could have been shared directly, we adopt a preventive approach by transmitting instead, to mitigate the risk of information leakage. Similar strategies for protecting exchanged quantities have been proposed in prior work, including 3 . Covariate-node k can use the simplified expression in Algorithm 1 to compute the standard errors of the parameter estimate for . Methodology for the dual optimization program and stopping criterion in VALORIS The response-node solves the minimization problem in ( 4 ) to obtain from which the ’s are calculated. The details of the box-constrained convex optimization method used to compute in our implementation are provided in Supplementary Methods - Box-constrained optimization algorithm and stopping criteria . The stopping criterion used in the VALORIS algorithm, which is independent of the specific optimization method employed, is given by where the gradient of the dual objective function is given by As we demonstrate in Supplementary Methods - Box-constrained optimization algorithm and stopping criteria , this entails the bound for all . Methodology for assessing privacy-preserving properties We carried a privacy analysis to ensure that individual-level data could not be reconstructed using reverse-engineering based on the notion of admissible candidate datasets –that is, admissible candidate matrices for covariate data and admissible candidate vectors for the response vector. For the purposes of the privacy analysis, we use the theoretical solution (instead of its approximate solution ) and its derived quantities. In addition to facilitating analytical derivations, this assumption provides an upper bound on potential privacy loss, as numerical implementations may introduce small perturbations that, in some cases, obscure exact reconstruction without eliminating the underlying risk. We also assume, as typically met in practice, that at least two covariate-nodes–including one potentially co-located at the response-node–participate in the analysis; for every individual , the scaled covariate values of this i th individual stored at node k are all different (i.e. for ); none of the values are exactly equal to the associated-column mean (i.e. for all i , j ); the sample size is such that ; and there exists at least two observations such that and two such that . Methodology to assess the privacy-preserving properties of quantities shared by a given covariate-node not co-located with the response-node Considering a given covariate-node , our analysis focuses on the potential reconstruction of the scaled data matrix , even though access to does not necessarily permit recovery of the original data matrix . This methodological choice makes the results for continuous covariates more robust to adversarial nodes accessing external information regarding either covariates mean or covariates standard deviation, and thereby represents an additional layer of privacy protection. We examine the set of quantities available to the response-node at a given point in time during the execution of Algorithm 1. We note that the response-node has temporary access to before Step 4 of the algorithm. After the algorithm has been run, the response-node has potential access to subset of the ’s and the ’s, depending on whether covariate-node k chooses to disclose them. Our analysis aims to assess whether, when attempting to solve for using the disclosed quantities and available information, whenever applicable, the solution space–defined as the set of data matrices compatible with the available quantities or information–contains, for every entry of , at least two admissible candidate matrices that differ at that entry. We define an admissible candidate matrix for as one that satisfies the following two conditions: (a) the disclosed quantities could have been equivalently computed from in place of , in which case is called a candidate matrix for ; and (b) there exists a matrix such that for each , all entries in column j of lie in the support of covariate j , e.g., for binary covariates and for continuous ones, and such that is a column-wise centered and scaled version of , in which case is said to be admissible . When only the local Gram matrix is available to the response-node. Let be the set of real-valued matrices. When the local Gram matrix is the only quantity shared from covariate-node k to the response-node, reverse-engineering requires the response-node to solve for the system of equations , under the constraints that has empirical mean zero (i.e. ) and empirical variance one (i.e. , where denotes the vector of diagonal entries of any square matrix ). It can be directly verified that, as necessarily meets all requirements for such matrix , it follows that also does. Whatever the nature (binary or continuous) of the covariates contained in , is an admissible candidate matrix because taking the negative values of the centered and scaled matrix preserves the nature of the covariate. Therefore, as under the assumption that no value in takes the exact value of its associated column mean, we always have two admissible candidate that differ for every entry. While we do not expand on that matter here, in many settings, many more admissible candidate matrices, and even infinitely many, exist. This is explained by the fact that the product with an orthogonal matrix preserves the original Gram matrix. Indeed, consider such that . It suffices to note that, since , we have . However, this does not ensure that is an adequate candidate for a scaled data matrix, nor that it can be taken as an admissible matrix in regards to the nature of the covariates. When only parameter estimates and their standard errors are available to the response-node, without the local Gram matrix and quantities derived from it. This scenario is non-specific to our proposed method and arises in most vertically partitioned logistic regression when estimates and standard errors are publicly disclosed. While few information is available at the response-node under this scenario, investigations were conducted (see Supplementary Methods - Privacy-preserving properties for details). As a result, the condition ensures that sharing those estimates when the Gram matrix is unknown can be considered at least as private as sharing the Gram matrix to run the algorithm in the first place. Note that, in cases where all covariate-nodes–except possibly the one located at the response-node–contain only binary covariates, Privacy level II may not be attained. Indeed, due to the binary nature of the covariates unknown to the response-node, the response-node could theoretically enumerate all possible datasets formed by every combination of 0s and 1s for each entry. It could then identify those consistent with the quantities it possesses (i.e., parameter estimates or standard errors) by fitting the logistic regression model in ( 5 ) to each candidate dataset using the response vector it holds and comparing the resulting estimates to the disclosed values. In such cases, privacy may fail to hold, as it is possible that no two distinct datasets are consistent with the quantities available to the response-node. However, beyond the uncertainty regarding the uniqueness of the admissible candidate dataset, this procedure is computationally demanding. Methodology to assess the privacy-preserving properties of quantities shared by the response-node Consider a given covariate-node located outside of the response-node, assumed to be adversarial, and recall that the response-node shares with the latter the vector and the matrix , respectively. In the following analysis, we examine covariate-node k ’s ability to reconstruct any entry of based on and . We assume that at least two covariate-nodes participate in the analysis (including the possibility that one is co-located with the response-node), that has full-column rank, that and that at least one continuous covariate is held outside of covariate-node k . First, cannot be retrieve from at covariate-node k, since where is any other matrix selected in the null-space of . Since is symmetric and invertible (because is symmetric positive-definite (as defined in ( 8 )), and the sum of a positive-definite and a positive semi-definite matrix is itself positive-definite) while the matrix lies in the null space of , the values of cannot be recovered. We now examine the ability of covariate-node k to retrieve the response vector from . To do this, and recalling that covariate-node k has access to and to , let To ensure sharing preserves privacy, one needs to verify that, for , there exists a vector with , such that . The goal is to ensure that every entry of the response vector can be flipped and still lead to an admissible candidate response vector. This can be done using linear programming algorithm designed to find feasible solutions under linear inequality constraints (see algorithm and details in Supplementary Methods - Privacy-preserving properties ). Finally, when a covariate-node is co-located with the response-node, an adversarial covariate-node could attempt to infer the covariate data held by the response-node. The reconstruction risk in this setting is conservatively assessed using the privacy analysis from when only parameter estimates and their standard errors are available to the response-node, without the local Gram matrix and quantities derived from it; the risk of retrieving the response-node’s covariate data is lower, since the adversarial covariate-node does not have access to . In the absence of continuous covariates held outside the adversarial covariate-node–i.e., when all other covariate-nodes contain only binary covariates–privacy may not be attained, since the adversarial node could theoretically enumerate all possible datasets, and in some cases, only one may be consistent with the quantities it possesses. Methodology for real health data applications We applied the VALORIS algorithm detailed in Algorithm 1 to two cases involving real heath data and performed analyses in R (version 4.4.1) 21 . These real health data cases where selected to include both numerical and binary covariates, to represent cases with sample size respectively lower than 100 and higher than 10000, and to allow for varying number of covariate-nodes. Complete-case analyses were conducted, whereby individuals with missing values were excluded. When presented, Wald-type CIs for the j th covariate were computed using . Computational details including wall-clock time and peak memory usage were reported in Supplementary Table S6 . Experiments were run on a computer under Windows 11, with an Intel Core i7-11390H processor running at 3.40GHz, using 16GB of RAM. The reported measurements are necessarily dependent on the specific hardware and software environment; they are reported to provide indicative order-of-magnitude assessments rather than absolute performance guarantees. The empirical criterion regarding the privacy-preserving properties for the response vector was verified (see Supplementary Methods - Privacy-preserving properties ) and was met in both analyses, such that privacy was ensured for the response-node data. The analysis using a de-identified clinical dataset from the Necker-Enfants Malades Hospital was performed in the context of the C’IL-LICO project. The C’IL-LICO project and study protocol received approval from the French National Ethics and Scientific Committee for Research, Studies and Evaluations in the Field of Health (CESREES) under the number #2201437. The data processing was approved by the French Data Protection Authority (CNIL) with a waiver of informed consent under number DR-2023- 017//920398v1. All methods were performed in accordance with the relevant guidelines and regulations. Supplementary Information Supplementary Information. (519.3KB, pdf) Acknowledgements We thank Xiaomeng Wang for preprocessing clinical data used in the application of the method. Author contributions F.C.L., M.P.D., A.B. and J.F.E. conceived and designed the study. F.C.L., M.P.D. and J.F.E. wrote the manuscript. The mathematical derivations were conducted by F.C.L. and M.P.D. Implementations were carried out by F.C.L., M.P.D., J.P.M. and J.F.E. All authors read and approved the final manuscript. Funding This work was supported by the Natural Sciences and Engineering Research Council of Canada - Discovery Grant; the Health Data Research Network Canada, an initiative funded by the Canadian Institutes of Health Research; and the Chaire de recherche en informatique de la santé de l’Université de Sherbrooke. Marie-Pier Domingue received a scholarship from the Natural Sciences and Engineering Research Council of Canada. Jean-François Ethier received a Clinical Research Scholar Junior 2 from the Fonds de recherche du Québec - Santé. This study was performed in the context of the C’IL-LICO project, a research initiative coordinated by the Imagine Institute that was supported by state funding from The French National Research Agency (ANR) (Reference: ANR-17-RHUS-0002). This work was supported by State funding from the Agence Nationale de la Recherche under “Investissements d’avenir” program (ANR-10-IAHU-01). Data availability The synthetic dataset to test the implementation in R is publicly available on GitHub. The MIMIC-IV dataset is available online under certain conditions, including completion of mandatory training. The de-identified clinical dataset from the Necker-Enfants Malades Hospital used only as an example in this study is not publicly available following institutional officials recommendations. The code used in this study is available on GitHub: https://url.griis.ca/valoris . Declarations Competing interests The authors declare no competing interests. Ethics approval and consent to participate As described in the Methods section, the C’IL-LICO project and study protocol received approval from the French National Ethics and Scientific Committee for Research, Studies and Evaluations in the Field of Health (CESREES). The data processing was approved by the French Data Protection Authority (CNIL) with a waiver of informed consent, and all methods were performed in accordance with the relevant guidelines and regulations. Footnotes Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. Félix Camirand Lemyre and Marie-Pier Domingue contributed equally to this work. Supplementary Information The online version contains supplementary material available at 10.1038/s41598-026-41936-y. References 1. Dai, W. et al. VERTICOX: Vertically distributed cox proportional hazards model using the alternating direction method of multipliers. IEEE Trans. Knowl. Data Eng. 34 , 996–1010. 10.1109/TKDE.2020.2989301 (2022). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 2. Kamphorst, B., Rooijakkers, T., Veugen, T., Cellamare, M. & Knoors, D. Accurate training of the Cox proportional hazards model on vertically-partitioned data while preserving privacy. BMC Med. Inform. Decis. Mak. 22 , 10.1186/s12911-022-01771-3 (2022). [ DOI ] [ PMC free article ] [ PubMed ] 3. Karr, A., Lin, X., Sanil, A. & Reiter, J. Privacy-preserving analysis of vertically partitioned data using secure matrix products. J. Off. Stat. 25 , 125–138 (2009). [ Google Scholar ] 4. Li, S. et al. Federated and distributed learning applications for electronic health records and structured medical data: a scoping review. J. Am. Med. Inform. Assoc. 30 , 2041–2049. 10.1093/jamia/ocad170 (2023). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 5. Du, W., Han, Y. S. & Chen, S. Privacy-preserving multivariate statistical analysis: Linear regression and classification. In Proceedings of the 2004 SIAM international conference on data mining. 222–233. 10.1137/1.9781611972740.21 (2004). 6. Kikuchi, H., Hashimoto, H., Yasunaga, H. & Saito, T. Scalability of Privacy-Preserving Linear Regression in Epidemiological Studies. In 2015 IEEE 29th International Conference on Advanced Information Networking and Applications , 510–514, 2015, 10.1109/AINA.2015.229. 7. Kikuchi, H., Hamanaga, C., Yasunaga, H., Matsui, H. & Hashimoto, H. Privacy-Preserving Multiple Linear Regression of Vertically Partitioned Real Medical Datasets. In 2017 IEEE 31st International Conference on Advanced Information Networking and Applications (AINA) , 1042–1049, 2017, 10.1109/AINA.2017.52. 8. Slavkovic, A. B., Nardi, Y. & Tibbits, M. M. Secure Logistic Regression of Horizontally and Vertically Partitioned Distributed Databases. In Seventh IEEE International Conference on Data Mining Workshops (ICDMW 2007) , 723–728, 10.1109/ICDMW.2007.114 (IEEE, Omaha, NE, USA, 2007). 9. Fienberg, S. E., Nardi, Y. & Slavković, A. B. Valid Statistical Analysis for Logistic Regression with Multiple Sources. In Protecting Persons While Protecting the People , 82–94, 10.1007/978-3-642-10233-2_8 (Springer, Berlin, Heidelberg, 2009). 10. Gonçalves, C., Bessa, R. J. & Pinson, P. A critical overview of privacy-preserving approaches for collaborative forecasting. Int. J. Forecast. 37 , 322–342. 10.1016/j.ijforecast.2020.06.003 (2021). [ Google Scholar ] 11. Li, Y., Jiang, X., Wang, S., Xiong, H. & Ohno-Machado, L. VERTIcal grid lOgistic regression (VERTIGO). J. Am. Med. Inform. Assoc. 23 , 570–579. 10.1093/jamia/ocv146 (2016). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 12. Kim, J., Li, W., Bath, T., Jiang, X. & Ohno-Machado, L. VERTIcal grid lOgistic regression with confidence intervals (VERTIGO-CI). In AMIA Summits on Translational Science Proceedings , vol. 2021, 355 (2021). [ PMC free article ] [ PubMed ] 13. Kuo, T.-T., Gabriel, R. A., Koola, J., Schooley, R. T. & Ohno-Machado, L. Distributed cross-learning for equitable federated models - privacy-preserving prediction on data from five California hospitals. Nat. Commun. 16 , 10.1038/s41467-025-56510-9 (2025). [ DOI ] [ PMC free article ] [ PubMed ] 14. Domingue, M.-P. et al. Revisiting VERTIGO and VERTIGO-CI: Identifying confidentiality breaches and introducing a statistically sound, efficient alternative, 10.21203/rs.3.rs-6933988/v1 (2025). [ Submitted Preprint ]. 15. Brink, C. et al. Distributed learning optimisation of cox models can leak patient data: Risks and solutions [preprint]. arXiv:2204.05856 (2022). 16. Faviez, C. et al. Performance and clinical utility of a new supervised machine-learning pipeline in detecting rare ciliopathy patients based on deep phenotyping from electronic health records and semantic similarity. Orphanet J. Rare Dis. 19 , 55. 10.1186/s13023-024-03063-7 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 17. Johnson, A. et al. Mimic-iv clinical database demo (version 2.2). PhysioNet 10.13026/dp1f-ex47. (2023) 18. GRIIS. Valoris implementation - examples. Available at https://url.griis.ca/valoris . (2025). 19. Tangri, N. et al. Multinational assessment of accuracy of equations for predicting risk of kidney failure: a meta-analysis. JAMA 315 , 164–174. 10.1001/jama.2015.18202 (2016). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 20. Tangri, N. et al. A Predictive model for progression of chronic kidney disease to kidney failure. JAMA 305 , 1553–1559. 10.1001/jama.2011.451 (2011). [ DOI ] [ PubMed ] [ Google Scholar ] 21. R Core Team. R: A Language and Environment for Statistical Computing. R Foundation for Statistical Computing , Vienna, Austria (2023). 22. Duan, R. et al. Learning from electronic health records across multiple sites: A communication-efficient and privacy-preserving distributed algorithm. J. Am. Med. Inform. Assoc. 27 , 376–385. 10.1093/jamia/ocz199 (2020). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 23. Aggarwal, C. C. & Yu, P. S. Privacy-Preserving Data Mining: Models and Algorithms (Springer, New York, NY, USA, 2008). [ Google Scholar ] 24. Ogier du Terrail, J. et al. FedECA: federated external control arms for causal inference with time-to-event data in distributed settings. Nat. Commun. 16 , 10.1038/s41467-025-62525-z (2025). [ DOI ] [ PMC free article ] [ PubMed ] 25. Nardi, Y., Fienberg, S. E. & Hall, R. J. Achieving both valid and secure logistic regression analysis on aggregated data from different private sources. J. Priv. Confidentiality 4 , 10.29012/jpc.v4i1.617 (2012). 26. Bertsekas, D. P. Projected newton methods for optimization problems with simple constraints. SIAM J. Control Optim. 20 , 221–246. 10.1137/0320018 (1982). [ Google Scholar ] 27. Schmidt, M., Kim, D. & Sra, S. Projected Newton-type Methods in Machine Learning. In Optimization for Machine Learning , 305–330, 10.7551/mitpress/8996.003.0013 (The MIT Press, Cambridge, MA, USA, 2011). 28. Woodbury, M. A. Inverting modified matrices. Memorandum report 42. Department of Statistics, Princeton University. (1950). 29. Strang, G. Linear Algebra and Its Applications (Thomson, Brooks/Cole, Belmont, CA, USA, 2006). [ Google Scholar ] Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Supplementary Materials Supplementary Information. (519.3KB, pdf) Data Availability Statement The synthetic dataset to test the implementation in R is publicly available on GitHub. The MIMIC-IV dataset is available online under certain conditions, including completion of mandatory training. The de-identified clinical dataset from the Necker-Enfants Malades Hospital used only as an example in this study is not publicly available following institutional officials recommendations. The code used in this study is available on GitHub: https://url.griis.ca/valoris . Articles from Scientific Reports are provided here courtesy of Nature Publishing Group ACTIONS View on publisher site PDF (3.3 MB) Cite Collections Permalink PERMALINK Copy RESOURCES Similar articles Cited by other articles Links to NCBI Databases Cite Copy Download .nbib .nbib Format: AMA APA MLA NLM Add to Collections Create a new collection Add to an existing collection Name your collection * Choose a collection Unable to load your collection due to an error Please try again Add Cancel Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top