  Medical data are often highly sensitive, and frequently there are missing
data. Due to the data's sensitive nature, there is an interest in creating
modelling methods where the data are kept in each local centre to preserve
their privacy, but yet the model can be trained on and learn from data across
multiple centres. Such an approach might be distributed machine learning
(federated learning, collaborative learning) in which a model is iteratively
calculated based on aggregated local model information from each centre.
However, even though no specific data are leaving the centre, there is a
potential risk that the exchanged information is sufficient to reconstruct all
or part of the patient data, which would hamper the safety-protecting rationale
idea of distributed learning. This paper demonstrates that the optimisation of
a Cox survival model can lead to patient data leakage. Following this, we
suggest a way to optimise and validate a Cox model that avoids these problems
in a secure way. The feasibility of the suggested method is demonstrated in a
provided Matlab code that also includes methods for handling missing data.
