6. Unique Patient Identifier based on Biometrics

I. Description of the Option

Biometric identification consists of patients' personal physical characteristics such as finger print, retina scan, iris scan, voice and DNA analysis. Some of the concerns relating to this option are organ transplant, amputation and diseases affecting organs (such as retinopathy). Biometric identification has been used by government agencies such as law enforcement and immigration. The photo included in an individual's driver's licence or employee ID, thumb print in legal documents, etc. are examples of Biometric Identification. Video-graphed, photographed or scanned image will be used for identification. It can be stored in digitized format in computers and ID Cards. Both for the issue and verification, the individual must be present. The process requires special purpose equipment such as scanner, video camera, computer and card readers with the necessary matching algorithms.

II. Author/Proponent and Documentation

1. Biometric Identification has been in use for a long period of time in various fields such as law enforcement, department of transportation, etc.

III. Compliance with ASTM Conceptual Characteristics

a) Functional Characteristics

Accessible: For accessibility, this method requires the establishment of a local issuing mechanism for the identifier and a central administration to handle its nationwide scope.

Assignable: In addition to the establishment of a local issuing mechanism and a central administration, the physical presence and cooperation of patients, the necessary tools and equipment such as scanner, video, etc. must all be present and functional.

Identifiable: The physical characteristics used in the Unique Patient Identifier based on Biometrics can be matched with the physical characteristics of the individual it identifies. However, additional information such as name, date of birth, etc. must also used in the identification data base.

Verifiable: Verification of the identifier will depend on the computer algorithm and equipment used

Mergeable: Duplicate IDs can be merged via cross-referencing

Splittable: Same ID issued to more than one individual can be handled by issuing new IDs to both or one of the individual.

b) Linkage of Lifelong Health Record

Linkable: The Unique Patient Identifier based on Biometrics can be used to link patient records from multiple sources.

Mappable: Bidirectional linkage is possible between the Unique Patient Identifier based on Biometrics and the existing Identifiers.

c) Patient Confidentiality and Security

Content Free: Biometric Identifier is based on the personal information of the individual.

Controllable: It is possible to encrypt the Unique Patient Identifier based on Biometrics. However, this capability is subject to the appropriate specifications, design and development that are yet to be organized.

Healthcare Focused: Biometric Identifiers are used in other industries too.

Secure: It is possible to use encryption and the local issuing entity or a central administration can handle the security of the encryption scheme.

Disidentifiable: It is possible to encrypt the Unique Patient Identifier based on Biometrics.

Public: Biometric Identifier consists of personal information, therefore, not meant to be public.

d) Compatibility with Standards and Technology

Based on Industry Standards: There is no national standard for the issue, maintenance and use of Biometric Identifiers.

Deployable: The necessary technology and processes to issue, maintain and use the Biometric Identifiers are available but, considered expensive, time consuming and cumbersome.

Usable: Other than an individual's photograph, the Biometric Identifier is not conducive to manual processing.

e) Design Characteristics

The creation, maintenance and use of Biometric Identifiers such as photo, thumb print, DNA analysis, retina scan, etc. will require special equipment, processes and procedures. They will be required both at the issuing and the verification points. In addition, adequate communication and computer capabilities will be required by all users of the ID. Therefore, a Central Trusted Authority to oversee the operation with the necessary administrative and technology infrastructure is necessary.

Unique: The information contained in the Identifiers is unique.

Repository-based: Biometric Identification is usually supplemented by other demographic information such as name, address, etc. It can be based on a repository of identification information.

Atomic: The Unique Patient Identifier based on Biometrics can be considered as a single data item.

Concise: Biometric Identifiers are usually not concise. Digitized images will require large amount of storage.

Unambiguous: Other than an individual's photograph, the Biometric Identifier is not conducive to manual processing or recognition.

Permanent: The Unique Patient Identifier based on Biometrics is intended to be permanent. However, amputation, organ transplantation, etc. can directly affect the Biometric Identifier (i.e. Thumb Print, Retina Scan, DNA Analysis).

Centrally governed: The Unique Patient Identifier based on Biometrics requires both local issuing mechanism and a central administration.

Networked: The Biometric Identification System can be supported by computer networks.

Longevity: Biometric Identifiers do not use numbering system and can be used for a foreseeable future.

Retroactive: The Unique Patient Identifier based on Biometrics can be assigned retroactively to all existing individuals.

Universal: The Unique Patient Identifier based on Biometrics can be assigned to all living individuals for a foreseeable future.

Incremental Implementation: The Unique Patient Identifier based on Biometrics can be implemented incrementally.

f) Reduction of Cost and Enhanced Health Status

Cost-effectiveness: Biometric Identification is generally considered expensive and cumbersome to use.

IV. Compliance with Operational Characteristics and Readiness

Currently operational: The Unique Patient Identifier based on Biometrics is not currently operational.

Existing infrastructure: Does not have existing administrative and technical infrastructures.

Readiness of the required technology: The necessary scanning and video technology, voice and DNA analysis technology are available.

Timeliness: Biometric Identification is generally considered cumbersome and time consuming to issue, maintain and use. It will require longer time period to implement than other options.

Adequacy of information to support identification functions: The identification data base and its contents have not yet been addressed.

V. Compliance with Unique Patient Identifier Components Requirements

Identifier

There are several options available for a biometric identification such as finger print, retina scan, iris scan, voice, DNA analysis, etc. Scanned or video graphed images serve as the identifier. The actual choice or choices from these various methods for use in healthcare have not been made.

Identification Information

Biometric identifier will require identifying data elements such as name, data of birth, etc., to support healthcare functions. But a proposal addressing these identification information is non-existent.

Index

An index that links the identifier and the identification information would be necessary. But a proposal addressing such an index is not in existence.

Mechanism to protect, mask or encrypt the identifier

Encryption is not being proposed for this option.

Technology Infrastructure

Does not have the required technology infrastructure in place to support healthcare functions, nor does a proposal for its creation exist.

Administrative Infrastructure

Does not have the required administrative infrastructure in place to support healthcare functions, nor does a proposal for its creation exist.

VI. Compliance with Basic Functions Criteria

Biometrics identifiers are currently used for applications that require positive identification of individuals. They are quite suitable for low volume activities such as personal identification verification. But their use in high volume transactions processing such as record keeping, information management, report generation, manual and or electronic exchange of information, coordination of multi-disciplinary team work and sensitive and timely healthcare delivery functions have not been tried. The Unique Patient Identifier based on Biometrics does not meet several of the operational characteristics and the identifier components requirements. Its ability will depend on the development of a complete proposal and inclusion of missing components and operational requirements. It will be unable to meet the basic functions discussed below without them.

Identification of individuals

Delivery of care functions: The ability to support the manual and automated identification of an individual during the delivery of care processes will depend on the format and content of the identifier, its ease of use, the turn around time, implementation of the remaining identifier components and the ability to meet all of the operational requirements.

Administrative functions: The ability to support the identification required by practitioners, provider organizations and secondary users for administrative functions will depend on the format and content of the identifier, its ease of use, the turn around time, implementation of the remaining identifier components and the ability to meet all of the operational requirements.

Identification of Information

Coordination of multi-disciplinary care processes: Multi-disciplinary functions and coordination of care processes including, ordering of procedures, medications, tests, etc., communication of results and consultations will depend on the format and content of the identifier, its ease of use, the turn around time, implementation of the remaining identifier components and the ability to meet all of the operational requirements.

Organization of patient information and medical record keeping: Manual medical record keeping and automated collection, storage and retrieval of information during the course of active treatment will depend on the format and content of the identifier, its ease of use, the turn around time, implementation of the remaining identifier components and the ability to meet all of the operational requirements.

Manual and automated linkage of lifelong health records: This ability will depend on the format and content of the identifier, its ease of use, the turn around time, implementation of the remaining identifier components and the ability to meet all of the operational requirements.

Aggregation of health information for analysis and research: The aggregation of health information on the basis of groups of patients, regions, diseases, treatments, outcomes, etc. for research, planning and preventive measures will depend on the format and content of the identifier, its ease of use, the turn around time, implementation of the remaining identifier components and the ability to meet all of the operational requirements.

Support the protection of privacy, confidentiality & security

Access Security: The Access Security and the authentication procedures needed to access the patient care information are not addressed.

Content-free Identifier: The identifier contains the patient's physical identification characteristics.

Mask/Hide/Encrypt/Protect/Disidentify: Encryption is not addressed.

Improve health status and help reduce cost

The method appears to lack the ability to support several basic functions. It is missing several operational characteristics and identifier components. The inclusion of missing characteristics, establishment of both the administrative and technology infrastructures, design and development of computer software, hardware, and communication networks, and implementation of security measures, etc. will require substantial investment of resources, time and effort.

VII. Strengths and Weaknesses

Strengths:

  1. The Unique Patient Identifier based on Biometrics meets most of the ASTM conceptual characteristics (of the 30 requirements, fully meets 20 and partially meets 3).
  2. It has the potential to provide positive identification of the patient.
  3. It avoids crossover problems from an existing system that need to be remedied or those that cannot be corrected retrospectively

Weaknesses:

  1. The Unique Patient Identifier based on Biometrics in its current form does not meet three of the five operational characteristics and the fourth one is not fully addressed.
  2. It does not meet four of the six identifier components requirements and the remaining two are not addressed adequately.
  3. Verification of the identifier requires special equipment, computer software, and expertise (DNA analysis, Finger Print, Retina Scan, etc.).
  4. Verification process for the identifier requires longer period of time (DNA analysis, Finger Print, Retina Scan, etc.) and can affect the timely delivery of care.
  5. Biometric Identification is generally considered cumbersome and time consuming to issue, maintain and use. It requires longer time period to implement than other options.
  6. Since the Biometric Identifier contains an individual's personal characteristics and information, the risk of violation of privacy and confidentiality is greater than that of other options.
  7. While Biometric Identifiers have proven to be a good option for Law Enforcement and Immigration and Naturalization departments, its potential for identifying individuals, linking and aggregating patient information from multiple provider organizations for the purpose of delivering care or research will depend upon its design which is yet to be planned and developed.
  8. Untested - implementing a brand new system nationwide that has not been proven in healthcare industry has inherent risk for its success.
  9. The required technology infrastructure and administrative structures need to be established.
  10. The method requires creation of a Central Trusted Authority, development of its organizational structure and operating procedures, definition of its authority and an implementation plan.
  11. Overcoming/solving the above weaknesses will require a substantial investment of money, huge effort and a longer time frame.

VIII. Potential Barriers & Challenges to Overcoming the Barriers

  1. Inclusion of the missing identifier components and operational characteristics
  2. Biometric Identifiers contain personal characteristic information. It poses threat to the violation of an individual's privacy.
  3. Unique Patient Identifier based on Biometrics is not ready for implementation. It will present several challenges to completing the various preliminary tasks including the nation-wide system design, development and implementation.
  4. Establishment of the Central Trusted Authority and determining the required administrative and technology infrastructure
  5. Cost
  6. Timeliness.

IX. Solutions to the Barriers:

  1. Selection of a choice from among the different biometric identification methods
  2. Development of identifier specifications, design, etc.
  3. Establishment of a Central Trusted Authority
  4. Development of technology infrastructure including software, hardware and communication issues
  5. Development of implementation methodologies, policies and procedures
  6. Preparation of a cost-benefit analysis and an implementation plan.