Why Identity Reconciliation Is a Dosing Safety Check
A dosing model can use valid measurements, a suitable population model, and a correctly calculated regimen—and still produce an unsafe recommendation if the inputs belong to different people. In a point-of-care workflow, the system must establish not only that a record exists in the EHR and a result exists in the laboratory system, but also that both records refer to the same patient and that the clinical events are correctly linked to that patient.
Identity reconciliation is the controlled process of resolving identifiers from different systems to a patient identity suitable for the dosing task. It is not simply a text comparison of names. An EHR medical-record number, a laboratory-system patient number, an encounter identifier, and a specimen accession number may all identify different kinds of things. Treating them as interchangeable can attach an otherwise accurate result or recommendation to the wrong person.
A useful representation of an identifier is the pair \((N, V)\), where \(N\) is its namespace or assigning authority and \(V\) is its value. The value alone is not a globally reliable key. For example, “004812” in a hospital EHR and “004812” in an external laboratory system may refer to different people. A crosswalk should therefore retain both values and their sources rather than replacing them with one unqualified number.
What Must Be Reconciled
A dosing workflow often combines a patient record, a medication history, laboratory results, and event times. Identity checks need to establish a chain of association across these objects, not merely a match between two demographic screens. The chain should make it possible to answer: which source patient record supplied the data, which patient identity that source record maps to, and which encounter, medication event, or specimen each clinical datum belongs to.
Common sources of mismatch include duplicate charts, incorrectly merged or split records, changes of name, transposed dates of birth, reused local identifiers, multiple identifier namespaces, and manual entry errors. Laboratory data introduce additional risks: an accession number is not a patient identifier; a sample may be relabelled or routed; and a result may appear in a different system from the order that initiated testing. These possibilities are reasons to check the data lineage, not reasons to assume that a discrepancy is harmless.
For a dosing recommendation, a minimum auditable association can be described as follows: the source patient identifier is resolved to an enterprise patient identity; the relevant encounter, medication history, and specimen are linked to that identity; and any identity or linkage conflicts are either resolved by an authorized process or cause the recommendation to stop. The mapping should include who or what established it, when it was established, and whether it is active, disputed, or superseded.
The arrows are assertions that must be supported by system records or an authorized reconciliation process. A name similarity or a matching specimen time does not, by itself, establish the full chain. Identity reconciliation also does not replace the clinical checks on dose, event timing, or laboratory data described in the earlier material on aligning doses, samples, and clinical events in time and clinical data quality checks before recommendation.
Designing Match Rules and Safe Stops
A practical design distinguishes three outcomes: resolved, unresolved, and conflicting. A resolved association meets the defined evidence and provenance requirements. An unresolved association lacks sufficient evidence to establish identity. A conflicting association contains incompatible evidence, such as two authoritative identifiers mapping to different people. Both unresolved and conflicting cases should block the affected recommendation unless an authorized reconciliation process resolves them.
Rules should state which evidence is required and what happens when evidence disagrees. A common safe design uses an authoritative identifier with its issuer or namespace, plus an independent corroborating attribute or a verified system linkage. The exact policy depends on the source systems and the consequences of error. Names and dates of birth can help locate candidates, but they are not reliable unique identifiers by themselves. A matching name and birth date should not override a conflicting identifier or an unexplained specimen-to-patient linkage.
Record each source-system patient identifier with its assigning namespace. Do not discard the original identifiers after creating an enterprise mapping.
Apply the approved crosswalk or reconciliation rule. Preserve the evidence, source, timestamp, and status of the mapping.
Check that the medication events, encounter, laboratory order, and specimen are associated with the resolved patient, not merely with records that happen to share a date or name.
If a required link is missing, ambiguous, expired, or contradictory, withhold the recommendation and route the case for reconciliation.
Log the identifiers used, the rule or authorized action that resolved them, and the resulting patient identity so the recommendation can be traced later.
A deterministic rule gives the same result when the same defined identifiers and mappings are supplied. It is appropriate when the identifiers are governed, correctly scoped, and known to be reliable for the use case. Probabilistic or similarity-based matching can help generate candidate records when exact identifiers are missing or inconsistent. However, candidate generation is not the same as establishing identity. In a high-consequence dosing workflow, an uncertain similarity score should not silently become permission to attach a recommendation. Manual reconciliation can resolve cases that rules cannot, but it needs trained and authorized staff, recorded evidence, and a controlled correction process.
Worked Example: The Same Number in Two Identifier Namespaces
A hypothetical hospital EHR contains patient record H-004812, assigned by Hospital North. An external laboratory interface supplies patient record L-004812, assigned by Lab Central. Both records display the name “Jordan Lee” and the same birth date. The dosing service receives a laboratory result under L-004812 and medication history under H-004812. Should it combine these data?
Step 1: Scope the identifiers. The values are both 004812, but their identifiers are \((\text{Hospital North}, 004812)\) and \((\text{Lab Central}, 004812)\). Equality of the numeric values does not establish equality of the identifiers because their namespaces differ.
Step 2: Assess the corroboration. The matching name and birth date make the records a candidate pair, but they do not resolve the identity. They could be shared by different people, copied incorrectly, or out of date. No verified crosswalk or order linkage is given in the scenario.
Step 3: Decide whether the dosing input is safe to use. The evidence does not establish that the laboratory result belongs to the EHR patient. The service must not combine the result and medication history or issue a recommendation. It should mark the association unresolved and request reconciliation using an approved linkage, such as a verified patient crosswalk and the laboratory order’s patient association.
The safe conclusion is not that the records represent different people; the available evidence is insufficient to decide. “Unresolved” avoids both an unsupported match and an unsupported assertion of non-match.
Worked Reconciliation Cases
Worked Example: A Name Change and a Demographic Discrepancy
In a hypothetical case, the EHR shows patient P-7315 as “A. Rivera,” birth date 14 March 1986. The laboratory system shows patient Q-2209 as “Ana Rivera,” birth date 13 March 1986. The laboratory result is linked to an order placed during an encounter whose EHR record belongs to P-7315. The approved crosswalk lists Q-2209 as a laboratory identifier for P-7315, but flags the demographic discrepancy for review. What should the dosing service do?
Step 1: Do not treat a name difference as proof of non-match. “A. Rivera” and “Ana Rivera” could reflect an abbreviation or a name update. A one-day birth-date difference could be a transcription error, but it could also indicate a different person. Neither explanation is established by the values alone.
Step 2: Examine the linkage evidence. The crosswalk explicitly maps Q-2209 to P-7315, and the result is associated with an order from an encounter for P-7315. This is stronger evidence than demographic similarity alone. The flagged birth-date discrepancy remains a conflict that the dosing service’s policy must address.
Step 3: Apply the defined policy. If the approved rule permits use only after a documented identity review when a demographic conflict is flagged, the service must hold the recommendation until that review is completed. An authorized reviewer should confirm the source records and correct the demographic data or document the justified association. If the rule permits the verified crosswalk and encounter linkage to resolve this specific discrepancy, the service may proceed only after recording that resolution.
Conclusion. The system should not silently choose the matching name or the encounter link and ignore the date discrepancy. The result is usable only when the conflict has been resolved under a documented rule; otherwise, the recommendation remains blocked.
Worked Example: A Specimen Accession Is Not a Patient Match
A hypothetical dosing service receives a drug concentration labelled accession A-9081. The laboratory result screen displays the patient name “M. Chen.” The EHR medication history belongs to patient E-5520, also displayed as “M. Chen.” The sample collection time is consistent with the expected monitoring window. No order identifier or patient-level crosswalk is included in the message.
Step 1: Separate the identifiers. A-9081 identifies the laboratory accession or specimen. It does not identify the patient. The repeated name and plausible collection time do not supply the missing patient linkage.
Step 2: Identify the missing relationship. The service needs evidence linking accession A-9081 to a laboratory order and linking that order to a source patient identifier that resolves to E-5520. Without those links, it cannot establish that the concentration belongs to the patient whose medication history is being used.
Step 3: Apply the stop condition. Because the identity chain is incomplete, the dosing service must not use the concentration to generate a patient-specific recommendation. It should report an unresolved specimen-to-patient association and request the order or accession linkage from the source system.
Conclusion. A clinically plausible sampling time and matching display name do not compensate for a missing specimen-to-patient link. The recommendation can proceed only after the accession is traced through the order to the resolved patient identity.
Diagnostics, Alternatives, and Failure Modes
Identity checks should be observable in routine operation. Useful diagnostics include counts of unresolved and conflicting mappings, duplicate active identifiers within a namespace, identifiers that map to multiple enterprise identities, stale or superseded crosswalk entries, and results whose order or patient linkage is absent. Monitoring should distinguish a genuine patient mismatch from a data-transfer failure or an outdated mapping; otherwise, teams may misinterpret a technical outage as a clinical identity problem or vice versa.
| Approach | Useful role | Important limitation |
|---|---|---|
| Exact identifier match within a namespace | Efficient resolution when the identifier is authoritative and correctly scoped | Fails if the namespace is omitted, the source value is wrong, or records were merged incorrectly |
| Crosswalk-based resolution | Links identifiers across systems while preserving source provenance | Can propagate an incorrect mapping unless status, history, and conflicts are governed |
| Similarity-based candidate matching | Finds possible records when identifiers are missing or inconsistent | Similarity does not prove identity; false matches can attach data to the wrong person |
| Authorized manual reconciliation | Resolves exceptions using source evidence and local procedures | Can be inconsistent or unauditable without defined roles, evidence, and documentation |
Common failure signals include a sudden rise in unmatched laboratory records, one source identifier associated with multiple patients, a recommendation assembled from different source patient IDs, or a crosswalk that changes without a recorded reason. Another warning is a workflow that reports “no match” and then continues using demographic similarity as a fallback. The fallback changes the decision rule precisely when the primary evidence has failed.
A mistaken design is to treat every mismatch as a data-cleaning nuisance and choose the “closest” record so the workflow can continue. The correction is to make uncertainty an explicit state with a safe outcome: stop the patient-specific recommendation, preserve the conflicting evidence, and route the case for resolution. A reconciliation tool can improve throughput, but it should not conceal uncertainty or erase the source identifiers that explain how the association was made.
No matching strategy eliminates all identity risk. Even an exact identifier can be attached to a wrong chart at registration, and a crosswalk can carry forward a prior error. Controls therefore need both prevention and detection: validate namespaces and uniqueness, preserve linkage provenance, check consistency across patient and clinical-object associations, and audit exceptions and changes. Identity safeguards establish whose data are being considered; they do not establish that the data are clinically appropriate for the model.
Check Your Understanding
Answer each question, then compare your reasoning with the solutions below.
- Two systems provide the same patient-number value, but each number was assigned by a different organization. What additional information is needed before treating them as the same identifier?
- A laboratory accession matches the expected sample time and the patient’s displayed name, but no order-to-patient link is available. Should a dosing recommendation use the result? Explain.
- A crosswalk links a laboratory patient ID to an EHR patient ID, but the source records contain conflicting birth dates. What is the appropriate system response?
- Name two diagnostics that could reveal a failing identity-reconciliation process.
Solutions. (1) The assigning namespace must be retained, and an approved crosswalk or other authoritative evidence must establish that the two source identifiers resolve to the same patient. Equal values alone are insufficient. (2) No. The accession identifies the specimen, and neither the expected time nor a displayed name establishes its patient association; hold the recommendation until the specimen and order are linked to the resolved patient. (3) Mark the association conflicting or unresolved and follow the documented reconciliation policy. Do not silently ignore the discrepancy or proceed on the crosswalk alone if policy requires review. (4) Examples include monitoring unresolved and conflicting mappings, duplicate active identifiers within a namespace, one source ID mapping to multiple patients, missing specimen-order links, and crosswalk changes without recorded provenance.