Personally-identifying, protected health information (“PHI”) is stored in encrypted form in protected data records, and hash values derived from the PHI are stored in associated search records. A healthcare marketer may identify market segments of individuals by querying the search records using hashed query predicates, identifying protected data records based on the search record results, and providing anonymized data-record results to the healthcare marketer. Once a market segment has been anonymously identified, the marketer may cause personalized marketing messages to be generated for individuals in the market-segment without the marketer having been exposed to PHI associated with those individuals.