A computing system comprising one or more non-transitory computer-readable mediums storing computer-executable instructions that when executed by the computing system cause the computing system to perform a method, the method comprising: receiving, from a provider, de-identified data that describes a given subject, where the de-identified data includes a first level masking identifier assigned to the given subject by the provider, wherein the provider retains a mapping of the first level masking identifier to an original identifier; storing the de-identified data in a data store; wherein the instructions further comprise: removing the first level masking identifier from the de-identified data prior to storing the de-identified data in the data store; assigning a second level masking identifier to the de-identified data; maintaining a mapping of the first level masking identifier to the second level masking identifier for use in future processing receiving, from a seeker, a protocol validation query comprising a request to access de-identified data; determining whether the provider of the de-identified data authorizes the seeker to access the de-identified data; denying access to the de-identified data to seekers not authorized by the provider; when the seeker is authorized, receiving, from a seeker, one or more selection criteria; accessing a data store that stores de-identified data associated with a plurality of subjects; identifying subjects associated with de-identified data in the data store that meet the criteria; returning, to the seeker, a count, and list of second level masking identifiers, of identified subjects, such that de-identified data is not returned to the seeker; receiving, from the seeker, a second level masking identifier that uniquely identifies a subject; mapping the second level masking identifier to a first level masking identifier; providing the first level masking identifier to the provider; and tagging the identified subject to indicate that the subject's data should not be returned as a result to any other protocol validation queries for a predetermined time period. receiving, from a provider, de-identified data that describes a given subject, where the de-identified data includes a first level masking identifier assigned to the given subject by the provider, wherein the provider retains a mapping of the first level masking identifier to an original identifier; storing the de-identified data in a data store; wherein the instructions further comprise: removing the first level masking identifier from the de-identified data prior to storing the de-identified data in the data store; assigning a second level masking identifier to the de-identified data; maintaining a mapping of the first level masking identifier to the second level masking identifier for use in future processing receiving, from a seeker, a protocol validation query comprising a request to access de-identified data; determining whether the provider of the de-identified data authorizes the seeker to access the de-identified data; denying access to the de-identified data to seekers not authorized by the provider; when the seeker is authorized, receiving, from a seeker, one or more selection criteria; accessing a data store that stores de-identified data associated with a plurality of subjects; identifying subjects associated with de-identified data in the data store that meet the criteria; returning, to the seeker, a count, and list of second level masking identifiers, of identified subjects, such that de-identified data is not returned to the seeker; receiving, from the seeker, a second level masking identifier that uniquely identifies a subject; mapping the second level masking identifier to a first level masking identifier; providing the first level masking identifier to the provider; and tagging the identified subject to indicate that the subject's data should not be returned as a result to any other protocol validation queries for a predetermined time period. removing the first level masking identifier from the de-identified data prior to storing the de-identified data in the data store; assigning a second level masking identifier to the de-identified data; maintaining a mapping of the first level masking identifier to the second level masking identifier for use in future processing receiving, from a seeker, a protocol validation query comprising a request to access de-identified data; determining whether the provider of the de-identified data authorizes the seeker to access the de-identified data; denying access to the de-identified data to seekers not authorized by the provider; when the seeker is authorized, receiving, from a seeker, one or more selection criteria; accessing a data store that stores de-identified data associated with a plurality of subjects; identifying subjects associated with de-identified data in the data store that meet the criteria; returning, to the seeker, a count, and list of second level masking identifiers, of identified subjects, such that de-identified data is not returned to the seeker; receiving, from the seeker, a second level masking identifier that uniquely identifies a subject; mapping the second level masking identifier to a first level masking identifier; providing the first level masking identifier to the provider; and tagging the identified subject to indicate that the subject's data should not be returned as a result to any other protocol validation queries for a predetermined time period.