Advance Science with Privacy Preserving Record Linkage

PPRL is an approach for linking two or more records from a single individual without revealing their identity so that policymakers, decision-makers, scientists, researchers, clinicians, administrators, and others can glean information from their and other’s data and transform it into knowledge that can help this particular individual (for example, by designing precise medical treatments for them) or the public as a whole. 

Record linkage dates back to 1946 when Halbert L. Dunn of the United States National Bureau of Statistics coined the term to describe the process of assembling the records (or data) of an individual from birth to death. Since then, various organizations in the public and private sectors have been performing such record linkage. The traditional method for record linking uses combinations of direct personal identifiers, such as name, date of birth, social security number, and home address, to match records belonging to the same individual (see Figure 1). This requires sharing personally identifiable information (PII) across sources that link the records, which, of course, brings up a host of privacy and security concerns.

PPRL addresses data privacy and security concerns by using a hashing algorithm to encode PII and generate tokens and then sharing only the encoded tokens between organizations and sources (as shown in Figure 1). Tokens (strings of characters and numbers) generated using the same combination of PII by the same algorithm across data sources will be identical. They can be used to match records from the same individual without revealing their identity. These matched records of the same individual can then be linked (or combined) for use by researchers.

PPRL-based data linkage offers two key benefits:

• Data enrichment across two dimensions of data—diverse types and longitudinal—for the same individual: PPRL facilitates combining data of different types and over different periods of time (longitudinal) collected for the same individual by different sources. Different data types might include electronic health records (EHR), clinical trial data, surveys, claims, and environmental information.
• Broader data sharing: PPRL promotes broader data sharing and collaboration across multidisciplinary stakeholders while protecting the privacy of individuals whose data are shared. It also helps eliminate duplication of costly data generation—such as images or genomic data—that have already been collected by one source and made available for sharing.

Such enriched and more broadly shared data have greater potential to address unique and challenging scientific and public health research questions that a single or even a subset of data cannot answer. Further, with linked datasets, one can get more of a holistic view of the individual, enabling precision medicine, innovative research, establishment of disease or population-focused national patient registries, and public health monitoring.

With all the realized benefits and potential opportunities associated with PPRL, you might be wondering, why are more health researchers not using it? What do I need to know and do to use it for my research?

Five essential components must be addressed when considering PPRL (as shown in Figure 2): participants, data, technology, governance, and resources. These components intersect at various points to unlock the hidden insights from PPRL-linked data to address real-world use cases effectively and efficiently.

Below are some key considerations to take into account when implementing PPRL within or across organizations:

• Engender trust among participants whose data are to be linked and shared: Individual participants are at the heart of PPRL. In general, participants must give informed consent for data sources to link and share their data. Participants need to have confidence and trust that their data will not be shared or used outside of their consent. This can be addressed by including explicit language in the consent forms regarding linking and sharing their data and the associated risks, implementing robust oversight and governance that includes data privacy and security control mechanisms, and then educating participants on these measures so that it is a collaborative decision-making process with the participant. Research has shown that most participants are willing to share their data if the data is de-identified and appropriate privacy and security measures are in place.
• Use high-quality standardized data for tokenization and linking: Garbage in, garbage out applies to PPRL just as it does to other data-related realms. The quality of the PII used for encoding (for example, low rates of missing values or errors) is critical for generating tokens and the subsequent matches with high accuracy. Each data source needs to agree on the PII quality so that the data are standardized across sources before tokenizing and matching. In addition to the PII, the actual datasets should also be of high quality for the linked data to be of meaningful use. This is achieved by either collecting or harmonizing the data that have already been collected in a standardized manner using common data elements or data models. It is less efficient and more costly to standardize data after it has been collected.
• Mitigate any potential for re-identification of participants when linking datasets: Linking two or more datasets inherently raises the potential risk of re-identification even when each of the original datasets has been fully de-identified of all PII because the process of linkage leads to a richer dataset with more data points on the individual. Therefore, re-identification risk mitigation must be performed before linking the datasets, and disclosure avoidance measures are established before sharing the linked datasets. Some risk-mitigation mechanisms include suppressing or altering variables that, when combined, could potentially re-identify the participant; collapsing small counts of certain variables, such as race, ethnicity, or rare diseases; and perturbing data by adding noise. Some disclosure avoidance measures include reviewing outputs of linkage and using strict physical (e.g., a data enclave) or technical controls (e.g., a review committee) for data access.
• Establish rules for linking and using the linked data, ideally through standardized data-use agreements: Data have significantly greater value when shared with the broader health research community, but data sharing also brings some risks of misuse—especially when linked datasets are involved. Therefore, data sources who agree to linking must adhere to a set of best practices for linkage and must establish appropriate agreements with stringent terms for use, such as prohibiting attempts to re-identify the participant and penalties for re-identification, including legal actions, and prohibiting the sharing of linked data with non-approved individuals or linking data for non-approved purposes.