A Privacy-Aware Federated Framework With Self-Regulating Differential Privacy and Ontology-Based Lexical Substitution for Safe Clinical LLM Querying
LLM-powered healthcare analytics provides clinicians and government agencies with critical insights for effective public health management through intuitive natural language queries, thereby eliminating the need for dedicated IT support. Given the sensitive nature of medical records, our proposed framework is motivated by the requirement to incorporate strong privacy-preserving mechanisms to maintain the confidentiality of patient information. Our model achieves increased level of privacy and utility of healthcare data through five complementary mechanisms: 1) federated framework simulated across multiple healthcare sites to enable secure and scalable analysis of patient records; 2) Complementary NER and Regex based redaction of raw sensitive clinical data; 3) ontology-guided semantic abstraction; 4) access-controlled mechanisms; and 5) a novel two-stage self-regulating differential privacy with heterogeneous privacy budgets. Experimental results indicate that Gemini 3.1 Flash-Lite is the most effective language-model to implement our proposed system, outperforming both Claude Haiku 4.5 and GPT-4o models across a carefully curated set of four application-specific metrics namely numerical accuracy, intent accuracy, hallucination rate and task success rate. During the ablation analysis performed on three distinct datasets including a real-time hospital dataset, the observed progressive increase in consistency score, as components are added, underscores the significance of each mechanism and demonstrates that their combined integration is critical for achieving the maximum consistency score of 96%. Furthermore, scalability experiments conducted over a range of 1 to 10 federated sites indicate that the proposed system achieves a favourable balance between aggregation accuracy and computational efficiency, making it well-suited for large-scale deployments.