care often depends on the availability of a complete medical record,18 and health outcomes research depends on the ability to undertake longitudinal studies on individuals (although not necessarily studies that are linked to the identities of these individuals). Detecting fraud may be possible only when abuse is revealed through unusual patterns of health care usage (linked through individual patient records).

Large, integrated delivery systems and managed care programs routinely assign patients identifiers for use within their health care systems without generating much controversy.19 What generates the largest amount of controversy is the prospect that a universal identifier will facilitate attempts to link information within and across much larger boundaries. For example, the idea of using the Social Security number (SSN) as a universal health identifier raises concerns not only that all medical data associated with a given individual can be linked, but also that an individual's medical data could be linked with financial data, purchasing habit data, family details, and other items of information—many of which are already indexed by the SSN—to create a personally identifiable, inter-linked record containing sensitive information. The use of any single number as a universal identifier could expand beyond its initial intent and become widespread in other domains, just as use of the SSN expanded well beyond the realm of identifying Social Security records.20

Adoption of a universal patient identifier would raise concerns about its use to link large numbers of personal data transactions in two distinct areas:

  1. Discrimination: Sensitive or adverse information may be used against an individual's economic interests in some way. For example, an employer may refuse to hire or promote an individual with a long and expensive history of medical claims (or with the prospect of expensive or chronic medical problems in the future based on genetics or family history).
  2. Loss of privacy: Many individuals have medical conditions that they might wish to keep private (e.g., a history of sexually transmitted diseases or treatment for depression). Even if an individual is not subject


It is advantageous for a patient in the emergency room or one who is being treated for substance abuse to have medical data linked so that care providers can make clinically informed decisions regarding care.


If health care moves to a more integrated service model in which large megaorganizations are responsible for more dimensions of care and an individual has less choice in selecting the organization with which he or she will interact, controversy may yet develop.


Szolovits, Peter, and Isaac Kohane. 1994. "Against Universal Health-care Identifiers," Journal of the American Medical Informatics Association 1:316-319.

The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement