Regional hospitals hold valuable patient data but cannot share it because of privacy rules. We train a 30-day readmission model across nine hospitals using federated averaging with differential privacy, so raw records never leave each site. The federated model achieves an AUC of 0.81, compared with 0.73 for the average single-hospital model, at a privacy budget of epsilon 3. We release the training pipeline and a governance checklist that hospital IT teams can adopt.