Proceedings from an International Workshop, Montreux, Switzerland: Unique Identifier Systems Key concepts Unique Patient ID Brainstorming Meeting Nairobi, Kenya November 10, 2009 Xenophon M. Santas U.S. Centers for Disease Control and Prevention Global AIDS Division

Acknowlegdements Shaun Grannis, M.D. Regenstrief Institute Indiana University School of Medicine Mark Shields, M.D. CDC-Zambia Philippe Boucher WHO-Geneva

Presentation Overview Unique identifier characteristics Examples of unique person identifiers System implementation considerations Deployment considerations

Unique identifier characteristics (1) Uniqueness. A unique identifier should identify one and only one individual, and ideally a person should have only one unique identifier. Ubiquity. A unique identifier should be accessible whenever and wherever it is required for healthcare purposes. Ubiquity is not intrinsic to the identifier -- rather it is a reflection of the perceived usefulness and the defined the scope for the identifier.. May be highly specific, such as for use at only one clinic; a specific care program such as a multi-drug-resistant tuberculosis; or for broad use such all public and private healthcare organizations. Scope. May be highly specific, such as for use at only one clinic; a specific care program such as a multi-drug-resistant tuberculosis; or for broad use such all public and private healthcare organizations.

Unique identifier characteristics (2) (ASTM 1714) Global system-level capabilities. Include accessible, assignable, identifiable, verifiable, mergeable, and splittable. For example, verifiability – the ability to determine that an identifier is or is not valid – is is often accomplished by including a check digit. Longitudinal linkage characteristics highlight the specific ability of an identifier to aggregate data across multiple systems over time. These characteristics include being linkable and mappable (e.g., to an existing medical record number).

Unique identifier characteristics (3) (ASTM 1714) Confidentiality and security characteristics address the ability of an identifier to protect and preserve patient privacy. These characteristics include being content free, controllable, healthcare focused, secure, de-identifiable, and public. Standards-based characteristics describe the degree to which an identifier complies with existing approaches. These characteristics include being compatible with existing industry standards, deployable, and usable. For example, deployable indicates that an identifier can be implemented using different technologies such as smart cards, barcode readers, and paper.

Unique identifier characteristics (4) (ASTM 1714) Design characteristics highlight properties inherent to either the actual identifier or the system maintaining the identifiers. Include being unique, repository-based, atomic, concise, unambiguous, permanent, governed, network, long-lasting, retroactive, universal, and incremental. However, contrast concise – as short as possible to support efficient entry – with long lasting – sufficiently long to accommodate information over time. The cost-effectiveness characteristic addresses how well a unique identifier system provides maximum functionality while minimizing deployment and operational costs.

Examples of unique person identifiers (1) Serial number. Creating sequentially increasing integers, with or without leading zeros (0001, 0002, 0003, …) is one of the simplest methods for assigning unique numbers. Forms the basis for some of the distributed methods described below. Globally unique identifiers (GUID). An exceedingly large number of unique values, produces 3.4×1038 possible values, and can be created locally on any computer. An example GUID is: {3F2504E0-4F89-11D3-9A0C-0305E82C3301} Its lack of an explicit check digit and length limit its usefulness for manual data entry applications.

Examples of unique person identifiers (2) Quasi-unique personal identifying elements. Not guaranteed to be unique, a combination of nearly constant personal demographic elements, including given name, surname, sex, birth date, mothers first name, mothers maiden name, fathers first name, birth location, and birth order. These elements are necessary to perform identity validation when an identifier is lost; are not typically used as the identifier itself. Blocked serial number. Combines a centrally determined nationally-unique site code with serial numbers issued by that site. However, system may assign multiple identifiers to a single patient.

Examples of unique person identifiers (3) Biometrics. Includes voice patterns, fingerprints, iris patterns, facial shapes, and vein patterns. Advantages: they are highly specific to an individual; identity can be verified without documents or cards that may be lost, stolen, or altered. Disadvantages include relatively expensive cost; instances where the identifiers evolve – voice patterns can change gradually with age, fingerprints can degrade (disappear) with time. Privacy concerns remain because of the potential for biometrics, particularly fingerprints, to be used by law enforcement agencies.

Examples of unique person identifiers (4) Identifiers with additional functionality. Identifiers may convey additional features such as privacy and security. The ASTM 1714 document describes a process to include security information in the identifier to indicate whether a particular identifier is intended for fully-identified use (e.g., in patient care) or as a private limited-use token (e.g. for population level reporting or research). May be desirable from a system implementation perspective, but then the identifier compromises the principle of being content free.

System implementation considerations (1) Transitioning from pre-existing identifiers. A unique identifier will be deployed either in the absence or presence of an existing health ID. If one already exists, the existing systems must be altered to accommodate the new identifier. This may be expensive. Historical data must be mapped to the new identifier. New workflows may be needed. Central versus distributed architecture. Assigning and managing identifiers may be conducted either by a central assigning authority or may be distributed and coordinated among many loosely connected or disconnected sites. Limitations in resource-constrained settings (e.g., unreliable or nonexistent network connectivity) may dictate that the assignment of unique identifiers be distributed.

System implementation considerations (2) Trusted authorities. Refers to an entity that performs functions crucial to a unique healthcare identifier system. May be a single trusted authority, or multiple trusted authorities operating in a distributed fashion. Functions of a trusted authority include: - Implements policies and procedures for granting access to existing identifiers - Maintains confidentiality and security by providing encryption/decryption or other processes - Assigns new unique identifiers - Maintain linkages between multiple identifiers - Ensures uniqueness of assigned identifiers

System implementation considerations (3) Matching algorithms. Although a unique healthcare identifier can improve patient identity management, it is not a panacea; sophisticated matching methods are a necessary component of any robust unique identifier system. Patient matching methods will still be needed for the following functionalities: –Retrieving clinical information when a unique identifier is absent –Reconciling duplicate identifiers –Incorporating historical data –Verifying identity (identity theft and the sharing of identifiers) –Verifying absence/presence of an identifier (i.e., prior to assigning a new identifier)

System implementation considerations (4) Assigning identifiers. Real-world workflows for patient registration and care are highly variable. The processes for assigning unique healthcare identifiers will also vary. But workflows for assigning unique identifiers must include: –Initiate request for new identifier by an authorized local entity (e.g., the patient, a clinical or administrative entity). –Provide identifying traits (e.g., name, birth date, gender) –Identity verification, i.e., verify that no unique identifier has been previously assigned. –Return new identifier. If a unique identifier is present, the existing identifier is used. If no existing unique identifier is found, the trusted authority generates a new unique identifier.

Deployment considerations (1) ASTM 2553 details a voluntary universal healthcare identifier system. Below we conclude by highlighting features of some example approaches.