The result of the analysis indicates that none of the options in its present form is a perfect choice. Existing options require enhancements to add features/functions and correct existing problems. New options are at a conceptual level and lack operational characteristics and several of the required components. But, they also embody new ideas and features. Each one of them brings its own unique strength. Collectively, they account for the various requirements of the Unique Patient Identifier. However, none of the options by itself meets all of the requirements. Some of the identifier concepts are not fully developed. Unique Patient Identifier is a critical need of the healthcare industry with impact on the privacy of individuals. The nation must adopt a method that can fully address the people's need including protection of their privacy, and it cannot limit its choice to incomplete ideas and methods.
This study analyzed both the Unique Patient Identifier requirements (including conceptual, operational, functional and components requirements) and the various available options (13 altogether including MRN). The analysis and examination of the Unique Patient Identifier requirements highlight the importance of all of the components that make up the identifier, their operational characteristics and functional capabilities. These components include:
Use of Unique Patient Identifier and maintenance of up-to-date identification information, security and access control require multiple participants including the patient, issuing authority, system developers, provider organizations and other users to cooperate and support the identifier functions. These Unique Patient Identifier components facilitate their participation.
Analysis of the various available options reveals that they focus more on the Identifier Scheme component and less on the remaining five components. The ASTM Guide treats implementation and policy issues to be beyond its scope. Results from ASTM's own evaluation of its Sample UHID indicate that several important characteristics such as Accessible, Assignable, Controllable, Governed, Identifiable, Secure and Unique depend on implementation and policy issues that are beyond the scope of its Guide. As a result, all of the Unique Patient Identifier options meet the ASTM conceptual characteristics almost equally with minor exceptions, but leave a wide gap in addressing the components that are necessary to support all of the functions of the Unique Patient Identifier and its operational requirements. Consequently, SSN, currently operational as a Unique Patient Identifier, emerges as the only option that meets both the operational characteristics and component requirements of a Unique Patient Identifier.
A careful overall analysis reveals that in fact, it is the remaining components, such as Administrative and Technology Infrastructures, Identification Information (demographic information) and Security Encryption, that give functionality to the identifier components. They address specifically:
These critical functions are independent of the numbering scheme or the value of the identifier (i.e. the actual choice of the Unique Patient Identifier). They are not unique or proprietary to any particular Unique Patient Identifier (numbering) scheme or value. They can be implemented with any one of the five Unique Patient Identifier options.
This, in fact, enables us to separate the identification scheme from all other components. Since key functions such as access control, maintenance of up-to-date identification information and secure communication are addressed by the other components, a simple user friendly Unique Patient Identifier that is suitable for use by both humans and computers constitutes an ideal choice for the Unique Patient Identifier. We can, therefore, now choose a simple and reliable identification scheme and equip it with all of the required functionality by adding the remaining five components.
In order to fulfill the current Unique Patient Identifier need of healthcare industry, the following three (3) courses of action are available:
I. Enhance an existing option
II. Develop a conceptual level option to fruition
III. Develop or facilitate the development of an ideal option.
The only option that is being currently used as a Unique Patient Identifier is SSN. It is used by 20% of the population as a Unique Patient Identifier. It is also collected, stored and used as part of patients' demographic information by most of the healthcare organizations. SSN is also used as a secondary and confirmatory identifier by a large number of provider organizations. With its existing administrative and technology infrastructures, and operating procedures, SSN is at a higher level of readiness for implementation than other options. It meets the conceptual and operational characteristics, and component and basic functions requirements. Only the proposed enhancements need to be implemented. It is likely to require relatively less time, effort and resources because of its current use and readiness. According to a 1993 Harris poll (Health Information Privacy Survey 1993), the majority of the American population and organizational leaders favor SSN as a patient identifier. It offers an early solution while allowing other options that are not fully developed to mature.
Use of SSN by other industries presents the potential for linking an individual's health information with his or her financial or social information, resulting in discrimination and financial harm. However, a close look at these risks reveals that in fact, the security risk related to SSN is common to all Unique Patient Identifier options. In the absence of the necessary access control, linkages are possible under any of the options. It is easy for a computer to map data based not only on SSN, but any one, or more identification data elements such as name, address, sex, age, etc. and create linkages and references regardless of the identifier. Other industries have these identification data elements on individuals as well. It is the access control that protects against unauthorized access. The identifier design that separates the identification from access is the key to securing healthcare information. Without this design, both SSN and a brand new identifier will have a significant amount of exposure. As discussed in the Judicious Design section earlier, the Unique Patient Identifier's design should support its storage and transmission in an encrypted format to protect the identity of the individual.
The Enhanced SSN includes the use of encryption to mask the SSN. Depending on the need, it can be used in the encrypted format all the time or only when protection is needed. The encryption scheme can be administered either by a Cental Trusted Authority or by provider organizations themselves. Therefore, with the appropriate access control discussed earlier, the Enhanced SSN can be used as a valid Unique Patient Identifier.
The existing error level in SSN presents a threat to its accuracy and integrity. The Enhanced SSN proposal includes enhancements such as check-digits to address SSN's current problems and improve its capabilities further. The SSA is currently evaluating multiple options to enhance the SSN to eliminate errors and improve its security, integrity and related processes. It has submitted a report to the Congress outlining such options. In fact, the features and functions that are included in the new options can also be added to SSN. Other enhancements in the Enhanced SSN option include ID for emergency use, ID for individuals ineligible for SSN, increased SSN capacity, etc.
SSN is a simple, user friendly Unique Patient Identifier that can be used by both computers and healthcare professionals. Since it is already in use at most of the provider organizations, it is relatively easy to expand its role as the Unique Patient Identifier.
The remaining options discussed in this report, with the exception of Medical Record Number, are at a conceptual level. (A modified Sample UHID is piloted as an Internal Control Number to create an MPI, and the FHOP Standard Data Set is being tested on patient care data bases to eliminate duplicate records). These options mainly address the identifier scheme and lack remaining components and operational characteristics. They require significant development, including the following:
Some of the options provide identifiers that are too long for manual computation and use. Such lengthy identifier are difficult for the patient to remember and provider organizations to handle. Therefore, the impact on the operation of the provider organizations and users must be fully analyzed. These options also need the same level of Organizational Access Security and Design features and federal privacy legislation.
A well developed concept, such as Sample UHID or LHSTR Number or one of the other options, may be chosen based on their ability to meet the ASTM Conceptual Characteristics. It can be developed further to include those characteristics and components that are missing. Implementation of a new choice will avoid any carry over problems and provide a fresh start. But it will require a relatively longer time frame to develop, test and deploy than enhancing and adopting an existing option. Therefore, the impact of time, resource, effort and cost effectiveness must be thoroughly analyzed. Because of the developmental status of these options, it is possible that this choice may prove to be the most expensive and time-consuming.
None of the proposals including the ASTM Sample UHID, meets all thirty (30) ASTM conceptual characteristics. Most of them are not concise and not suitable for manual calculation and use. Some are not content-free. All are at a conceptual level, some with their concept not fully developed. Each option has different strengths and weaknesses. But collectively they represent all of the required characteristics of an ideal Unique Patient Identifier.
1) Therefore, instead of limiting the industry to one of these options, an ideal Unique Patient Identifier can be developed by consolidating all of the required characteristics. The time frame for its implementation will be comparable to that for one of the proposed conceptual level Unique Patient Identifiers. This course of action will yield the best possible Unique Patient Identifier choice.
2) Alternatively, instead of integrating together the independent proposals, we can foster the independent growth and maturity of the various options. This course of action will provide an opportunity for the competing options to mature. It can be accomplished by establishing leadership, setting the direction and functioning as a catalyst and facilitator to support and promote the growth and development of the various options. Over a period of time, the industry initiatives will mature and multiple efforts converge. Their capability and suitability can be assessed at appropriate intervals, taking into account the passage of the Privacy, Confidentiality and Security legislation by the U.S. Congress. There is an inherent risk that the progress of the options may remain stagnant. Appropriate leadership and support can bring success and benefit to this option. This course of action may cause delay and postpone the implementation of the urgently needed Unique Patient Identifier.
The revolution currently taking place in healthcare, information and communication industries presents both challenges and opportunities for patient care, research and cost saving. Unique Patient Identifier is a vital link to achieve innovation and quality healthcare. A simple and user friendly UPI that can fulfill all the requirements including security and confidentiality is the need of the hour. The healthcare industry has put forth options and alternative (total 12).
The new options for the Unique Patient Identifier still remain as concepts. For them to progress and materialize, a strong leadership is required to take the process in the right direction. Waiting for the various options to mature and succeed by themselves may not fulfill the need adequately or in a timely manner. On the other hand, existing options, such as SSN requires implementation of several enhancements proposed. In addition, appropriate design, architecture and procedures need to be implemented in order to assure the security of the process of identification process and access control. Therefore, in both cases, a strong leadership with a clear vision is required to steer the process to a successful completion. It will help establish the necessary administrative infrastructure and define its responsibility and authority. It will facilitate the development of required technology infrastructure including development of software, communication and hardware components. Three (3) of the alternatives to Unique Patient Identifier, namely CORBAMed, HL7 Mediation and Directory Service are currently planning the development of the technology infrastructure. A strong leadership can help coordinate these processes to progress in harmony to yield the best solution for the Unique Patient Identifier.