A new framework of privacy-preserving identity management for distributed e-Health systems is proposed. Utilizing a consumer-centric approach, the healthcare consumer maintains a pool of pseudonymous identifiers for use in different healthcare services. Without revealing the identity of consumers, health record data from different medical databases distributed in various clinic/hospitals can be collected and linked together on demand. While pseudo-anonymity preserves user privacy, the architectural design allows the anonymity to be revoked by a trusted authority under well-defined policies with legal-compliance. This framework inherits the advantages in centralized management for distributed medical databases. Security of the interactions among different entities in the architecture is guaranteed by certification and cryptographic technologies.