Privacy-Preserving Duplicate Record Detection Across Decentralized Healthcare Institutions

Abstract

Patient information can be duplicated across providers, which may lead to bias in patient counts and to loss of longitudinal analysis; however, patient demographics may not be allowed to be shared directly. Some of the most important issues that arise from HHN data sources are similar to those found in other typical hospital data sources, such as the MITRE Synthetic Denver FHIR dataset, which is used in this paper to implement and test a privacy-preserving record linkage (PPRL) benchmark. A total of 6,354 Patient resources were extracted from 5 simulated provider partitions using a synthetic identity label (ID) separate from the provider-partitioned matcher input elements. It normalizes seven demographic fields, creates Cross-Site Candidates via a Union of 4 HMAC-SHA-256 blocking keys, and compares records by Exact or Character 3-gram Weighted similarity per field. A Bloom filter exists for every position generated using a set of 3 HMAC-positions, and for the encoded method, the Bloom filter is encoded into a 128–1,024 bit size Bloom filter. It uses a held-out 65% identity-group split to test, and a deterministic 35% development split for thresholds. In the test set 604 true cross provider pairs were retrieved as blocking counts 554 of which (91.72%). At 1,024 bits, the Bloom-filter matcher achieved 0.941 precision, 0.891 recall, and 0.915 F1; a plaintext q-gram reference achieved 0.950, 0.889, and 0.919, respectively. Not actual results from real hospitals - these are synthetic results measured in a "realistic setting. The existing HMAC and Bloom tokens are pseudonymous codes, and can reveal known information about membership in the blocks and about similarities; there was no evaluation of any secure multiparty computation, differential privacy or end-to-end security protocol.