Enabling Privacy-Preserving Federated Learning in Healthcare: The FLAME Architecture and Policy Framework

Federated Learning enables collaborative AI development in healthcare without sharing patient data, addressing privacy and regulatory constraints like GDPR and HIPAA. We present FLAME, an open-source platform developed within the German PrivateAIM project, designed to ensure privacy-compliant and auditable federated analytics. FLAME uses a hub-and-node architecture, integrating privacy-enhancing technologies with a dynamic policy framework that specifies permissions and conditions for data access and algorithm execution. This framework allows distributed policy evaluation and enforcement across institutions. Initial deployments at German university hospitals demonstrated FLAME's capability to conduct federated analyses on clinical and genomic data with model performance comparable to centralized approaches. The system offers fine-grained access control, audit logging, and minimal overhead. FLAME provides a scalable foundation for secure, privacy-preserving AI in medicine, bridging legal, technical, and organizational requirements for multi-institutional collaboration.