National Patient Identifiers (from Precision Medicine and the Reinvention of Human Disease)

Readers from outside the United States are probably wondering why the United States agonizes over the problem of patient identification. In many other countries, individuals are given a unique national identifier, and all medical data associated with the individual is kept in a central data repository under the aegis of the government’s health service. A single, permanent identifier is used by a patient throughout life, in every encounter with a hospital, clinic, or private physician. As a resource for researchers, the national patient identifier ensures the completeness of data sets and eliminates many of the problems associated with poorly implemented local identifier systems.

In the United States, there has been fierce resistance to the idea of national patient identifiers. The call for a national patient identification system is raised from time to time. The benefits to patients and to society are many. Regardless, US citizens are reluctant to have an identifying number that is associated with a federally controlled electronic record of their private medical information. In part, this distrust results from the lack of any national insurance system in the United States. Most health insurance in the United States is private, and private insurers have wide discretion over the fees and services provided to enrollees. There is a fear that if there were a national patient identifier with centralized electronic medical records, insurers would withhold reimbursements or raise premiums or otherwise endanger the health of patients. Because the cost of US medical care is the highest in the world, medical bills for uninsured patients can quickly mount, impoverishing individuals and families.

Realistically, though, no data is safe. Medical records can be stolen, and governments can demand access to medical records, when necessary [See Lewin T. Texas orders health clinics to turn over patient data. The New York Times; October 23, 2015].

Life has its compromises. Everyone wants their privacy and we all get angry when we hear that our confidential information has been stolen. Data breaches today may involve hundreds of millions of confidential records. The majority of Americans have had social security numbers, credit card information, and private identifiers (e.g., birth dates, city of birth, names of relatives) misappropriated or stolen. It’s natural to object to anything that might jeopardize our privacy. Nonetheless, we must ask ourselves the following: “Is it rational to forfeit the very real opportunity of developing new safe and effective treatments for serious diseases, for the very small likelihood that someone will crack your deidentified research record and somehow leverage this information to your disadvantage?”

Suppose everyone in the United States were given a choice: you can be included in a national patient identifier system, or you can opt out. Most likely, there would be many millions of citizens who would opt out of the offer, seeing no particular advantage in having a national patient identifier, and sensing some potential harm. Now, suppose you were told that if you chose to opt out, you would not be permitted to use any of the therapeutic or preventive benefits that come from studies performed with data collected from the national patient identifier system. These lost benefits would include safe and effective drugs, warnings of emerging epidemics, information on side effects associated with your medications, biomarker tests for preventable illnesses, and so on. Those who made no effort to help the system would be barred from any of the benefits that the system provided. Would you reconsider your refusal to cooperate, if you knew the consequences? Of course, this is a fanciful scenario, but it makes a point.

- Jules Berman

key words: identification, confidentiality, privacy, medical identifier, NPI, national patient identifier, jules j berman, Ph.D., M.D.

OBJECT IDENTIFIER (AS USED IN DATA SCIENCE)

An object identifier is anything associated with the object that persists throughout the life of the object and that is unique to the object (ie, does not belong to any other object). Everyone is familiar with biometric identifiers, such as fingerprints, iris patterns, and genome sequences. In the case of data objects, the identifier usually refers to a randomly chosen long sequence of numbers and letters that is permanently assigned to the object and that is never assigned to any other data object (see Glossary item, Data object).

An identifier system is a set of data-related protocols that satisfy the following conditions: (1) Completeness (ie, every unique object has an identifier); (2) Uniqueness (ie, each identifier is a unique sequence); (3) Exclusivity (ie, each identifier is assigned to only one unique object and to no other object, ever); (4) Authenticity (ie, objects that receive identification can be verified as the objects that they are intended to be); (5) Aggregation (ie, all information associated with an identifier can be collected); and (6) Permanence (ie, an identifier is never deleted).

- Jules Berman (copyrighted material)

key words: identifier, identification, uniqueness, data object, jules j berman

REIDENTIFICATION UNDER HIPAA

Reidentification is a term casually applied to any instance whereby information can be linked to a specific person, after the links between the information and the person associated with the information have been removed. Used this way, the term reidentification connotes an insufficient deidentification process. In the health care industry, the term "reidentification" means something else entirely. In the U.S., regulations define "reidentification" under the "Standards for Privacy of Individually Identifiable Health Information.”(1) Therein, reidentification is a legally sanctioned process whereby deidentified records can be linked back to their human subjects, under circumstances deemed legitimate and compelling, by a privacy board. Reidentification is typically accomplished via the use of a confidential list of links between human subject names and deidentified records, held by a trusted party. In the healthcare realm, when a human subject is identified through fraud, trickery, or through the deliberate use of computational methods to break the confidentiality of insufficiently deidentified records (ie, hacking), the term "reidentification" would not apply.(2)

References

1. Department of Health and Human Services. 45 CFR (Code of Federal Regulations), parts 160 through 164. Standards for privacy of individually identifiable health information (final rule). Fed Regist 2000;65(250):82461–510.

2. Berman JJ. Principles of big data: preparing, sharing, and analyzing complex information. Morgan Kaufmann; 2013.

- Jules Berman (copyrighted material)

key words: identifier, deidentifier, identification, reidentification, privacy, HIPAA, confidentiality, medical records, jules j berman