Incomplete identity links
One person's information remains divided across identities. Clinicians may miss relevant history and duplicate investigations.
Executive judgement
Identity is a clinical safety dependency
A national EHR needs an authoritative way to determine which local records belong to the same person. That capability is essential even when the EHR is supplied by one vendor; it must still reconcile legacy records and connect services outside its own patient database.
An EMPI maintains identities, demographic evidence and links between identifiers issued by different systems. Patient matching is the process of identifying and linking a person's records within and across health systems [WEB-01]. The national capability can be supplied by a separate service or an assured component of a wider platform. Its responsibilities must be explicit in either case.
Incorrect identity links
Information from different people appears together. Clinical decisions and disclosure can then be based on the wrong record.
Trusted identity links
Correctly linked identifiers allow authorised services to retrieve the relevant records while preserving their source and provenance.
The clinical consequences above are architectural analysis, rather than quantified outcome claims. An EMPI reduces an important source of risk; effectiveness must be demonstrated in the implemented service.
The principles behind an EMPI
| Principle | Practical meaning |
|---|---|
| A person is not an identifier | A person may have several identifiers. An identifier must include its assigning authority or namespace, not just a number. |
| Identity is an evidence-based assertion | Record the source, verification status, effective dates and reasoning behind a link. Names and addresses can change; demographic agreement does not prove identity. |
| Keep source identities traceable | Retain local identifiers and their history. A national identity should allow cross-reference rather than silently erase source identity. |
| Separate linking from clinical consolidation | Linking identities does not itself move or combine clinical records. Consolidating clinical data requires separate controls and provenance. |
| Uncertainty needs a safe workflow | Ambiguous matches require review. New or provisional identities need controlled reconciliation rather than forced matching. |
| Corrections are part of normal operation | Provide authorised correction, unlinking and downstream repair with a complete audit trail. |
A national identifier helps, but does not replace identity management. Its absence, incorrect capture, duplicate assignment or association with the wrong person still needs to be handled. Identity resolution, identity proofing, staff authentication and access authorisation are distinct functions.
Explore the national architecture
The EMPI answers “which identifiers refer to this person?” A record locator answers “where is relevant information held?” Clinical repositories hold the information, and access services decide whether it may be disclosed. These functions can be packaged together, but their responsibilities remain distinct.
EMPI connections. Local identifiers are cross-referenced through a governed identity service. This enables patient identity resolution without requiring all clinical records to be copied into the index.
Matching is a decision under uncertainty
Deterministic matching uses explicit rules, such as agreement on a verified identifier. Probabilistic matching weighs agreement and disagreement across available evidence. Both require locally validated policies, representative test data and controls for contradictory evidence. A matching score is not automatically a calibrated probability of identity.
Explore the evidence conditions
This interaction compares principles, without using patient data or a numerical matching algorithm. The displayed decisions are educational guidance, not production rules.
Verified identifier agreement provides strong evidence when its assignment and capture are trustworthy. Validate the identifier's authority and status, and check for conflicts before applying an approved linking rule.
False positive
Different people are linked. Measure incorrect links and resulting harm, not just how many matches were made.
False negative
Records for one person remain separate. Measure missed links alongside duplicate identities and unresolved cases.
Review workload
Manual review is a funded service. Monitor queue age, adjudication quality and the safety of interim arrangements.
Increasing automatic linking can increase coverage while exposing more incorrect links. Tightening rules can reduce that exposure while leaving more genuine links unresolved. Neither policy is acceptable without measuring both error types and their consequences.
An identity service must survive correction
Registration is only the beginning. Identity information is updated, identifiers are retired, duplicate identities are reconciled and incorrect associations are discovered. Each change needs provenance and a controlled route to the systems that have used the identity.
Register, validate and update
Capture identifiers with their authorities and demographic provenance. Validate format and verification status, search for existing identities, and support provisional registration where evidence is incomplete. Preserve history when demographic information changes.
Link, reconcile and merge
A link asserts that source identities refer to one person. A merge usually retires a duplicate identity in favour of another, but product semantics differ. Define precisely what happens to identifiers, references, clinical data and downstream subscriptions before approving the operation.
Unlink and repair
Incorrect links require an authorised reversal process. Identify affected records, messages, caches, portal accounts and disclosures. Reversing an index link alone does not undo clinical decisions or repair all downstream copies.
Notify and audit
Publish identity changes reliably, preserve version and event history, detect failed consumers and reconcile missed updates. Record who changed an identity, what evidence was used and how affected services acknowledged the correction.
National governance should assign decision rights to [National identity service owner], [Local registration teams], [Identity stewardship team] and [Clinical safety lead]. These bracketed roles need named accountable entities in the programme design.
Why the national EHR programme needs this early
| Programme stage | Identity work required | Consequence if deferred |
|---|---|---|
| Design and procurement | Agree identifier domains, ownership, integration contracts, correction responsibilities and portability. | The programme can acquire incompatible identity models or unclear responsibilities. |
| Legacy migration | Profile identity quality, reconcile candidate duplicates and preserve source cross-references and unresolved cases. | Existing identity errors can be propagated into the national record. |
| Phased deployment | Manage coexistence with legacy and external systems, identity events and registration during disruption. | Patients may receive new duplicate identities or stale associations. |
| Clinical operation | Provide visible identity assurance, steward review queues, investigate incidents and repair downstream links. | Errors can persist across care settings and portals. |
| Expansion and supplier change | Onboard new domains and export identifiers, links, provenance and event history under agreed contracts. | Expansion and exit become costly and dependent on one supplier. |
For a national service, “enterprise” spans organisational boundaries. National rules need consistent local execution, supported by registration training, escalation routes and stewardship capacity. The EMPI should be treated as an ongoing service with safety and availability obligations, rather than a one-off data cleansing project.
Coverage must include people without an established national identifier, newborns, temporary identities and those whose demographic details are incomplete or change. Matching performance should be assessed across relevant population groups and care settings. Do not use the presence of an identifier as an eligibility rule for care.
Standards connect services; governance determines trust
| Standard / capability | Role | Boundary |
|---|---|---|
| IHE PIXm [WEB-02] | FHIR-based cross-reference queries between patient identifier domains. | Does not prescribe a national matching algorithm or demonstrate its accuracy. |
| IHE PDQm [WEB-03] | FHIR-based querying for patient demographic information. | A returned candidate still needs appropriate identity assurance. |
| IHE PMIR [WEB-04] | FHIR-based master identity lifecycle management and change distribution. | Implementation still needs operating procedures, correction controls and reliable consumers. |
| National identifier scheme | Provides an identifier within a governed issuing scheme. | Cannot alone resolve every historical, provisional or incorrectly captured identity. |
| Record location and clinical exchange | Find and retrieve information associated with resolved identities. | Separate from identity matching and clinical semantic interpretation. |
| Authentication and access policy | Establish the user or service identity and permit appropriate access. | A correct patient match is not permission to disclose data. |
An EMPI contains sensitive identifying information and links that can expose care relationships. Apply data minimisation, access controls, audit, security testing and applicable privacy law. The legal basis, identifier rules, retention and patient correction rights must be established for the jurisdiction and intended uses; this explainer does not determine them.
Interactive decision register
These are recommended assurance questions, not findings about a particular national programme. “High” denotes a potential patient safety or major service risk. Confidence refers to the architectural recommendation, not observed implementation performance.
6 decisions shown
| ID / dimension | Concern and required action | Severity / confidence | Evidence / sources |
|---|---|---|---|
| EMPI-01 Safety | Incorrect links can contaminate the longitudinal record. Validate matching policies and demonstrate correction across consumers. | High / High | Analysis WEB-01, WEB-04 |
| EMPI-02 Governance | Unclear ownership leaves uncertainty unresolved. Fund stewardship and approve decision rights and escalation routes. | High / High | Analysis WEB-01 |
| EMPI-03 Architecture | Cross-domain identity needs explicit namespaces. Specify identifier authorities and interoperable cross-reference contracts. | High / High | Fact + analysis WEB-02 |
| EMPI-04 Delivery | Migration can spread identity defects. Retain provenance and reconcile unresolved identities before and after cutover. | High / High | Analysis WEB-01, WEB-04 |
| EMPI-05 Architecture | A service interruption needs a safe response. Rehearse provisional registration, recovery and cache reconciliation. | Medium / High | Analysis WEB-04 |
| EMPI-06 Governance | Aggregate accuracy can conceal uneven performance. Evaluate false links, missed links and review delays by relevant cohort and setting. | High / High | Analysis WEB-01 |
Review readiness for national deployment
Use this checklist to structure discussion. Selecting a statement records an assertion for this session, not evidence of assurance or authorisation to deploy.
0 of 8 statements selected. Review the evidence for each item before drawing a readiness conclusion.
Method, sources and limitations
This is a principles-based architecture explainer informed by official patient matching guidance and published IHE profiles. Statements about interface responsibilities are source-based facts. Programme recommendations and risk implications are analysis. No national implementation, supplier product or patient dataset has been evaluated.
- WEB-01 · US health IT authority: Patient Identity and Patient Record Matching. Used for the definition of patient matching and its role in linking records. US guidance is not a legal requirement for other jurisdictions.
- WEB-02 · IHE: Patient Identifier Cross-referencing for Mobile (PIXm). Used to explain cross-reference queries and identifier domains.
- WEB-03 · IHE: Patient Demographics Query for Mobile (PDQm). Used to distinguish demographic queries from identity cross-reference services.
- WEB-04 · IHE: Patient Master Identity Registry (PMIR). Used for lifecycle and identity change distribution concepts.
Sources checked 7 October 2026. External references require internet access; the explainer and its interactions work offline. Confirm current profile versions, national requirements and implementation guidance when specifying contracts. No numerical accuracy, financial saving or clinical outcome is claimed.
All diagrams are conceptual. The matching interaction is deliberately qualitative and cannot be used to make patient identity decisions. Theme and checklist state last only while this page remains open. With JavaScript disabled, all explanatory content and the full decision register remain readable.