Evidence map›Paper›PMID 37147600›Full record

ArticleBMC medical informatics and decision making2023

De-identified Bayesian personal identity matching for privacy-preserving record linkage despite errors: development and validation.

Rudolf N Cardinal, Anna Moore, Martin Burchell, Jonathan R Lewis

Abstract read
In one paragraph

Article in BMC medical informatics and decision making, 2023. The graph could read no effect estimate from its abstract, so it casts no vote on the map. Cited by 1 paper.

0numbers the graph read from it
0cells of the map it votes in
1citing papers in PubMed
–field-weighted citation impact
1 · What the graph read from it

What it found

Each row is one number read from the abstract, on the scale the paper reported it, with its interval. Left of the dashed line favours the treatment, right favours the comparator. Under each row is the sentence it came from. New to these charts? A ten-minute tutorial.

The abstract states no effect estimate the extractor could read, or names no intervention and outcome on the map, so this paper lights no cell and moves no belief. It is still indexed, cited and linked below.

2 · The registry

The trial behind it

Trials whose registry record cites this paper, or whose number appears in the abstract. A trial that started after this paper was published is citing it as background, not reporting it.

Neither the registry nor the abstract names a trial number. If this is a trial report, that itself is worth knowing.

3 · Its place in the literature

Who cites it

1 citing paper in PubMed.

  1. Article
4 · The record

Corrections and comments

PubMed lists nothing against this paper. Absence here is not a guarantee, only a check that was made.

5 · Who and what money

Authors and funding

4 authors.

Rudolf N CardinalDepartment of Psychiatry, University of Cambridge, Cambridge Biomedical Campus, Clifford Allbutt Building, Bay 13, Cambridge, CB2 0AH, UK. rnc1001@cam.ac.uk.ORCID 0000-0002-8751-5167
Anna MooreDepartment of Psychiatry, University of Cambridge, Cambridge Biomedical Campus, Clifford Allbutt Building, Bay 13, Cambridge, CB2 0AH, UK.ORCID 0000-0001-9614-3812
Martin BurchellDepartment of Psychiatry, University of Cambridge, Cambridge Biomedical Campus, Clifford Allbutt Building, Bay 13, Cambridge, CB2 0AH, UK.ORCID 0000-0003-2447-8263
Jonathan R LewisCambridgeshire & Peterborough NHS Foundation Trust, Fulbourn Hospital, Cambridge, CB21 5EF, UK.ORCID 0000-0003-1821-3824

Funding

Department of Health BRC-1215-20014Department of Health NIHR203312Medical Research Council MC_PC_17213Medical Research Council MC_PC_21025Medical Research Council MR/T046430/1Medical Research Council MR/W014386/1
6 · The paper itself

Abstract

backgroundEpidemiological research may require linkage of information from multiple organizations. This can bring two problems: (1) the information governance desirability of linkage without sharing direct identifiers, and (2) a requirement to link databases without a common person-unique identifier.

methodsWe develop a Bayesian matching technique to solve both. We provide an open-source software implementation capable of de-identified probabilistic matching despite discrepancies, via fuzzy representations and complete mismatches, plus de-identified deterministic matching if required. We validate the technique by testing linkage between multiple medical records systems in a UK National Health Service Trust, examining the effects of decision thresholds on linkage accuracy. We report demographic factors associated with correct linkage.

resultsThe system supports dates of birth (DOBs), forenames, surnames, three-state gender, and UK postcodes. Fuzzy representations are supported for all except gender, and there is support for additional transformations, such as accent misrepresentation, variation for multi-part surnames, and name re-ordering. Calculated log odds predicted a proband's presence in the sample database with an area under the receiver operating curve of 0.997-0.999 for non-self database comparisons. Log odds were converted to a decision via a consideration threshold θ and a leader advantage threshold δ. Defaults were chosen to penalize misidentification 20-fold versus linkage failure. By default, complete DOB mismatches were disallowed for computational efficiency. At these settings, for non-self database comparisons, the mean probability of a proband being correctly declared to be in the sample was 0.965 (range 0.931-0.994), and the misidentification rate was 0.00249 (range 0.00123-0.00429). Correct linkage was positively associated with male gender, Black or mixed ethnicity, and the presence of diagnostic codes for severe mental illnesses or other mental disorders, and negatively associated with birth year, unknown ethnicity, residential area deprivation, and presence of a pseudopostcode (e.g. indicating homelessness). Accuracy rates would be improved further if person-unique identifiers were also used, as supported by the software. Our two largest databases were linked in 44 min via an interpreted programming language.

conclusionsFully de-identified matching with high accuracy is feasible without a person-unique identifier and appropriate software is freely available.

Indexed as

Medical Record LinkagePrivacyBayes TheoremHumansMaleSoftwareState MedicineBayesian probabilistic linkageDe-identificationElectronic health recordsElectronic medical recordsElectronic patient recordsIdentity matchingMental healthOpen-source softwarePrivacy-preserving record linkagePseudonymisationPsychiatry

Identifiers

PMID37147600
PMCPMC10163749

What OpenQuestion holds

Textmetadata
LicenceCC BY
Read underepoch 390

Registered trials

None linked

Read under generation 80e0d062 · epoch 390. Bibliography from PubMed, PubMed Central and OpenAlex; grants from NIH RePORTER; trial links from ClinicalTrials.gov; estimates, votes and beliefs from the OpenQuestion graph.