July-August 2020

Patient Identification During a Crisis
By Elizabeth S. Goar
For The Record
Vol. 32 No. 4 P. 14

The pandemic has brought more attention on the always contentious issue of a unique patient identifier.

When the postmortem is conducted on the nation’s response to the COVID-19 pandemic, few stones will be left unturned in determining what worked, what didn’t, and what can be fixed before the next pandemic—or the next wave of the current one—rears its head. Somewhere in there should be a question about what role, if any, a unique patient identifier (UPI) could have played in the response.

“This crisis highlights the importance of an identification scheme, which points back to the UPI,” says Dan Cidon, chief technology officer at NextGate. “And it’s not just the UPI but also on so many [other] fronts where we could be more effective. Interoperability is high on this list. Will this [pandemic] produce a sufficient level of pain” to move the UPI forward?

The Current Reality
The last action on a unique or national patient identifier was in July 2019, when the US House of Representatives voted to repeal the 21-year ban on funding. The Senate, however, failed to follow suit, and the prohibition remains in place.

The industry remains divided as to just how much good a UPI system could do. Organizations such as the College of Healthcare Information Management Executives (CHIME) and AHMIA have been vocal in their support for assignment of a single, unique health identifier. As recently as this March, CHIME submitted a letter to Senate Appropriations Committee Chair Sen. Richard Shelby reiterating its support for removing the funding ban.

In the letter, CHIME President and CEO Russell P. Branzell, CHCIO, LCHIME, wrote: “As our health care system moves toward nationwide health information exchange, consistency in identifying a patient remains conspicuously absent. Care providers are missing opportunities to improve a patient’s health when that patient’s data [are] not easily available. As data exchange increases among providers, patient identification errors and mismatches will become exponentially more problematic and dangerous.”

Opponents are just as vocal. Sen. Rand Paul, whose father, former Congressman Ron Paul, introduced the original language to the Labor-HHS appropriations bill in 1998 to ban funding of a national identifier, continues to vigorously support its opposition. In September 2019, he introduced the National Patient Identifier Repeal Act to overturn a requirement to create a unique health identifier.

“As a physician, I know firsthand how the doctor-patient relationship relies on trust and privacy, which will be thrown into jeopardy by a National Patient ID. Considering how unfortunately familiar our world has become with devastating security breaches and the dangers of the growing surveillance state, it is simply unacceptable for government to centralize some of Americans’ most personal information,” Rand stated in a press release announcing his legislation.

Somewhere in the middle are many patient identity and matching experts, who agree that a UPI could be beneficial but likely is not the panacea some have held it up to be.

“We still support that a UPI could improve matching, but it’s really just another strong identifier,” says Karen Proffitt, MHIIM, RHIA, CHP, vice president of industry relations and chief privacy officer for Just Associates. “In general, we support that a UPI should be pursued, or at least discussed, as part of the overall national matching strategy … but there’s no magic bullet. We need a multifaceted approach.”

Adds Michael Martz, senior vice president and CIO of Mount Nittany Health and a member of CHIME’s Policy Steering Committee, “We need to get to the point of working and talking collaboratively to get to the solution. It is inhibiting us from getting the right thing done. We need to work together to identify the common goal and come up with a solution to get patients identified with adequate security so [the UPI] is unlikely to be misused.”

What Might Have Been
What about in times of crisis? Would having a single UPI impact care received during, for example, the COVID-19 pandemic? It’s somewhat of an academic question, given the Congressional stalemate, but it is one that should nonetheless be examined.

“In a crisis—especially in a crisis—it’s difficult and burdensome for providers to get all the information they need,” says Proffitt, who points out the rapid adoption of telehealth and the possible use of trauma protocols as elements that have the potential to exacerbate the patient identification and matching challenge during a pandemic.

“We’re not on the frontlines and can only assume, but a crisis does further illustrate or shine a light on the [current] deficiencies with patient identification,” she says.

Debbie Condrey, CIO of The Sequoia Project, notes that a UPI could be potentially useful to public health agencies charged with monitoring the spread of COVID-19, including both surveillance and contact tracing—assuming the proper national tools were in place to support the process.

“The patient identifier certainly could be helpful in terms of a national response, especially if there were national tools that could be used for public health agencies to identify patients and demographics,” she says. “Also, from my experiences talking to public health agencies, they’re looking for additional clinical information about patients who are testing positive.

“Public health is, right now, fairly local, so national tools and those types of things will be evaluated during the postmortem,” Condrey continues. “However, right now, from what I know about most states, in public health they are using patient matching algorithms and doing what they can to match up [records]. It would be something to look at in the future, for sure.”

Dave Cassel, executive director of Carequality, also points to supporting public health agencies when examining the potential role a UPI could play in times of pandemic—particularly in terms of linking test results with medical records.

“Public health agencies often have very limited information. If a patient identifier existed and if it had been properly associated with test results, then it could very well have played a role,” he says, adding that while a UPI should be part of the COVID-19 postmortem, “it’s not going to crack the top five things we need to address. There are a number of things far more important.”

Cidon is more enthusiastic about the role a UPI could play in an improved pandemic response, pointing to the highly mobile nature of the US population and the critical need to be able to share patient information across states and regions.

“Look at the maps of infection rates across the US against this notion of boundaries,” he says. “How do you effectively share data across state lines or regions? It’s very hard to share information, not just for COVID but also across organizational boundaries. So a UPI or system-issued identifier for clinical domains would be helpful.”

According to Martz, the real benefit of a UPI is far more likely to be realized in the later phases of a pandemic response. In the early phases, the focus is on providing comfort care, while work is underway to identify an effective treatment. “The best we can do is help while they fight this on their own, so we’re not sharing patients with other organizations right now,” he says.

However, during later and often more deadly waves, a UPI could come into play to identify those who have already recovered and may potentially have at least temporary immunity and to track movement of the virus across geographic regions more effectively.

“This gets very centrally to the [role of the] UPI,” Martz says. “How can we [track] if we can’t identify the right people? Our lack of a UPI will hurt significantly when doing anything like that—if privacy even allows us to. That’s one of the biggest challenges with the UPI: security. Can we trust it? Can we build enough security around it? I would hate to see the UPI held back because we rushed too quickly and created a major debacle.”

Treading Lightly
The COVID-19 pandemic postmortem is unlikely to clear the gridlock holding back the development of a national identifier. While most agree that it could play a limited role in an improved national response, it’s likely insufficient to result in anyone overlooking the primary obstacle of ensured security and privacy.

“Having the ability to match patient identities is important. UPIs are really valuable when we’re otherwise unable to match patient identities,” notes Mariann Yeager, CEO of The Sequoia Project. “However, the bigger question is what are we trying to solve.”

“Our concern is that in the process of trying to come up with a solution, we can go overboard and privacy can go out the window. It’s important to [ensure] that control by the patient is respected,” Cidon says.

Finding the right balance is essential, as is an infrastructure that can securely maintain whatever UPI is developed by the system. It isn’t enough to be able to reliably identify the patient between encounters, according to Michael Trader, cofounder of RightPatient. There must be measures in place to prevent the current issues plaguing patient matching such as duplicate records or overlays, the rates of which tend to increase significantly when patient information is shared between diverse organizations.

“There are some benefits, like enabling more reliable data exchange between health care providers,” Trader says. “That being said, it doesn’t eliminate all the problems we hear about. Duplicates and overlays happen for a variety of reasons, and medical identity theft is just getting worse. Having a unique patient identifier won’t necessarily help in these situations.”

He says rather than solely depending on a unique identifier, the strongest system will pair that with another element, such as photo identification or a unique token—multifactor authentication and multiple credentials—to ensure accuracy and prevent mistakes.

“Having a single number that is stratified at the federal level potentially opens up concerns, which is one reason this initiative has faced so much headwind and is so politically charged,” Trader says, adding that providing an additional biometric token is critical to a full-scale UPI solution.

“Mistakes can have serious consequences, so it’s very important for health care providers to take a serious look at this and treat it with a high level of priority,” he says. “Even in health care systems that believe they have a great duplicate rate, it takes just one mistake, one circumstance where a patient’s existing record is missed and you don’t see that they have an allergy or are taking certain medications and there’s an adverse event.

“The floodgates are starting to open, making it even more important to have a platform in place,” Trader continues. “There is going to be so much more data moving across the ecosystem and so many more systems able to access data through APIs [application program interfaces]. You have to know who someone is.”

— Elizabeth S. Goar is a freelance writer based in Wisconsin.