Patient Identity Matching in Independent Practices: What the Evidence Supports

Research question

What can an independent physician practice validly conclude from its patient-matching data, and which measures distinguish a useful warning from a confirmed identity error?

Patient identity matching links records believed to describe the same person. The operational stakes are concrete: a missed match can fragment information across records, while a false match can place another person's information in view. Yet the most visible number in a work queue, the count of possible duplicates, is not an error rate. It is the output of a screening process whose sensitivity depends on the fields available, the rules used, and the population being compared.

This distinction matters especially in a small practice. A handful of alerts can look alarming when divided by a small registration count, and staff familiarity with patients may conceal weaknesses in the underlying data. The research question is therefore not which matching vendor is “best.” It is how to create an interpretable local audit from the evidence that public agencies and standards work provide.

Evidence and interpretation

ONC defines patient matching as identifying and linking a patient's data within and across systems to support a comprehensive record. Its overview notes that matching typically combines multiple demographic elements such as name, date of birth, phone number, and address. That definition rules out a common shortcut: one identical field is not proof of identity, and one different field is not proof that two records belong to different people.

ONC's national work also shows why data quality and algorithms must be analyzed separately. The Patient Identification and Matching Final Report described variation in attributes, formats, and organizational practices. The later Patient Matching, Aggregation, and Linking work tested a demographic-data quality framework and emphasized preventing duplicates as well as managing those already present. These materials support standardizing capture and measuring completeness; they do not supply a universal error percentage for every practice.

Address illustrates the point. Project US@ developed a standard way to represent addresses because inconsistent formatting can interfere with linkage. Standardization can make equivalent values easier to compare, but it cannot determine whether a patient moved, uses a mailing address, shares a household, or provided an incorrect value. A practice should therefore measure normalized completeness separately from identity adjudication.

ONC has also stated that no industry-accepted minimum baseline or universal testing approach exists for patient-matching algorithms. An algorithm's alert threshold changes the tradeoff between possible false matches and possible missed matches. Reporting “algorithm accuracy” without a labeled reference set, threshold, and error definition is not meaningful evidence.

The safety context is broader than data hygiene. ONC's SAFER materials treat correct patient identification as a health-IT safety concern, and AHRQ patient-safety resources describe wrong-patient events as a class that can arise at multiple points in care. Health information exchange increases the value of accurate linkage because outside data can improve record completeness, while also increasing the number of sources that must be reconciled.

Privacy remains part of validity. HHS guidance requires covered entities to limit uses and disclosures under the Privacy Rule, while identity checking for access is not the same activity as linking clinical records. NIST's digital identity guidance addresses proofing and authentication for digital services; it should not be cited as a clinical record-matching accuracy standard. Keeping these purposes separate prevents an access-control result from being misreported as proof that two medical records refer to the same person.

A defensible local measure

A useful audit begins with a declared unit. The numerator might be candidate pairs flagged by the system, candidate pairs reviewed, confirmed duplicate pairs, confirmed overlays, or registrations corrected before a duplicate was created. Each answers a different question. The denominator might be new registrations, all active patients, imported records, or candidate pairs reviewed. A percentage without both units is ambiguous.

For an independent practice, an adjudicated sample is more informative than a raw alert count. Freeze a defined observation window and export only the minimum fields required for approved review. Randomly sample candidate matches and, if technically possible, a set of apparently unmatched records. Have authorized personnel apply a written decision rule and record “match,” “not a match,” or “insufficient evidence.” Escalate uncertain cases rather than forcing them into a binary result.

Report at least four measures: demographic-field completeness at registration, the candidate-alert rate per registration, the confirmed-duplicate rate among reviewed candidates, and the proportion of reviewed candidates that remain unresolved. If a labeled reference set exists, report false-match and missed-match outcomes separately. A high alert rate with few confirmed duplicates may indicate an overly broad threshold; a low alert rate alone cannot show that missed matches are rare.

Stratification can reveal mechanism without turning the audit into profiling. Compare records by source system, registration channel, field availability, or whether address normalization was applied. Avoid conclusions about patient groups unless the sample and governance support them. Small cells should be suppressed to protect privacy and because unstable percentages can mislead.

Quality checks should include inter-reviewer agreement on a subset, duplicate candidate suppression, and a log of rule changes. If the matching configuration changes, calculate old and new rules over an overlap sample. That provides a direct comparison without claiming a before-and-after association proves a safety outcome.

The audit should also track balancing measures: records merged and later separated, corrections after outreach, delays caused by unresolved identity, and privacy or safety events. Speed alone is not success. A faster queue that increases incorrect consolidation shifts work and risk downstream.

Limits

Federal reports synthesize broad experience, but the underlying organizations differ from a solo office in patient volume, staffing, technology, and access to master-patient-index tools. Vendor-generated candidates are also not interchangeable because field weighting and thresholds differ. Results from one system cannot be transferred as a benchmark without validating the same definition and reference standard.

Manual adjudication is not infallible. Reviewers may use information unavailable to the algorithm, and familiarity with a patient can bias a decision. Conversely, a reviewer may lack enough evidence to resolve a pair safely. Reporting uncertainty is more honest than treating every unresolved record as either correct or erroneous.

Finally, duplicate-record discovery is only one side of matching performance. A queue reveals records the system suspected; it does not reveal all matches the system failed to propose. Estimating missed matches requires a labeled sample or another defensible detection method. That limitation should accompany any local result.

Methodology and conclusion

We reviewed ten sources from ONC, AHRQ, HHS, and NIST that address matching definitions, demographic quality, health-information exchange, patient safety, privacy, or digital identity. We retained the intended purpose of each source and did not combine security authentication with clinical linkage. We treated agency recommendations as framework evidence, not as measured outcomes in this practice.

The evidence supports a narrow conclusion. Independent practices can improve patient-identity analysis by standardizing demographic capture and auditing adjudicated outcomes, but a candidate duplicate count is not an error rate and a single matching field is not proof of identity. The defensible local report names the unit, denominator, threshold, review rule, uncertainty, and balancing measures. That approach turns a vendor queue into useful operational evidence without overstating what the data can establish.