Semantic Web-Based Information Systems: State-of-the-Art ...

Distributed Patient Identification Protocol 239
input values for a patient’s sex, year, month and day of birth, and so forth is
rather limited. A dictionary-based attack, therefore, would quickly re-identify
the plain-text source for these fields, along with most of the given names and
family names that also could be determined by means of a dictionary attack.
• Encryption: In the final step, each message digest is encrypted with a secret
encryption key that needs to be known by all parties in the protocol that
generate control numbers to be compared with each other. Each encrypted
message digest is called a control number, and the complete set of control
numbers describes the patient demographics in a form that does not allow for
the reproduction of any plain-text field by any party that does not have access
to the encryption key, but it allows for a comparison of two different sets of
control numbers without the need for access to the encryption key.
Given a set of control numbers describing a query and a larger number of sets of
control numbers describing all patients in a record repository, matches in the repository
can be identified using record linkage, defined by Winkler (1999) as “the
methodology of bringing together corresponding records from two or more files or
finding duplicates within files.” We propose the use of a probabilistic rather than a
deterministic record linkage algorithm, as described by Jaro (1989) as well as Blakely
and Salmond (2002). This class of algorithms not only compares each pair of control
numbers for equality, but it also considers the significance of each control number,
based on an estimation of the true positive rate and the false positive rate; that is,
the probabilities of a pair of identical control numbers of representing the same or
different patients. The probabilistic record linkage also allows one to compensate to
a certain degree for missing data (control numbers that are not available at the record
repository), typing errors, and so forth. Basically, the algorithm allows a person to
identify the most promising matches from a larger set. The final choice of records
that would be treated as definitive matches depends on a threshold and possibly
on human choice. Further issues in record linkage, such as array comparison, are
discussed in Aden, Eichelberg, and Thoben (2004).
Blocking.Variables
The protocol as previously described would require every record repository to create
a set of control numbers for each patient in the repository and to repeat this for
each incoming query because of the encryption key, which would change with each
request. This, of course, is not practical for a large number of patients. Therefore,
the protocol uses the concept of so-called blocking variables to reduce the number
of possible candidate records for which control numbers have to be computed and
evaluated. Blocking variables are simply plain-text demographics that are transmitted
in unencrypted form (a transport level encryption can be used, of course, but
Copyright © 2007, Idea Group Inc. Copying or distributing in print or electronic forms without written permission
of Idea Group Inc. is prohibited.