Two hospitals want to jointly compute aggregate statistics on shared patient outcomes to improve treatment protocols, but neither is legally permitted to disclose its raw patient records to the other, and neither trusts a third party to hold the combined dataset. A privacy engineer is asked to recommend a technique that lets both parties obtain the correct aggregate result while ensuring that neither party (nor any intermediary) can access the other's underlying records. Which privacy-enhancing technology best meets these requirements?