Search

Introduction Research data combined with administrative data provides a robust resource capable of answering unique research questions. However, in cases where personal health data are encrypted, due to ethics requirements or institutional restrictions, traditional methods of deterministic and probabilistic record linkages are not feasible. Instead, privacy-preserving record linkages must be used to protect patients' personal data during data linkage. Objectives To determine the feasibility and validity of a deterministic privacy preserving data linkage protocol using homomorphically encrypted data. Methods Feasibility was measured by the number of records that successfully matched via direct identifiers. Validity was measured by the number of records that matched with multiple indirect identifiers. The threshold for feasibility and validity were both set at 95%. The datasets shared a single, direct identifier (health card number) and multiple indirect identifiers (sex and date of birth). Direct identifiers were encrypted in both datasets and then transferred to a third-party server capable of linking the encrypted identifiers without decrypting individual records. Once linked, the study team used indirect identifiers to verify the accuracy of the linkage in the final dataset. Results With a combination of manual and automated data transfer in a sample of 8,128 individuals, the privacy-preserving data linkage took 36 days to match to a population sample of over 3.2 million records. 99.9% of the records were successfully matched with direct identifiers, and 99.8% successfully matched with multiple indirect identifiers. We deemed the linkage both feasible and valid. Conclusions As combining administrative and research data becomes increasingly common, it is imperative to understand options for linking data when direct linkage is not feasible. The current linkage process ensured the privacy and security of patient data and improved data quality. While the initial implementations required significant computational and human resources, increased automation keeps the requirements within feasible bounds.

Background The linkage of records across administrative databases has become a powerful tool to increase information available to undertake research and analytics in a privacy protective manner. Objective The objective of this paper was to describe the data integration strategy used to link the Ontario Ministry of Children, Community and Social Services (MCCSS)-Social Assistance (SA) database with administrative health care data. Methods Deterministic and probabilistic linkage methods were used to link the MCCSS-SA database (2003-2016) to the Registered Persons Database, a population registry containing data on all individuals issued a health card number in Ontario, Canada. Linkage rates were estimated, and the degree of record linkage and representativeness of the dataset were evaluated by comparing socio-demographic characteristics of linked and unlinked records. Results There were a total of 2,736,353 unique member IDs in the MCCSS-SA database from the 1st January 2003 to 31st December 2016; 331,238 (12.1%) were unlinked (linkage rate = 87.9%). Despite 16 passes, most record linkages were obtained after 2 deterministic (76.2%) and 14 probabilistic passes (11.7%). Linked and unlinked samples were similar for most socio-demographic characteristics (i.e., sex, age, rural dwelling), except migrant status (non-migrant versus migrant) (standardized difference of 0.52). Linked and unlinked records were also different for SA program-specific characteristics, such as social assistance program, Ontario Works and Ontario Disability Support Program (standardized difference of 0.20 for each), data entry system, Service Delivery Model Technology only and both Service Delivery Model Technology and Social Assistance Management System (standardized difference of 0.53 and 0.52, respectively), and months on social assistance (standardized difference of 0.43). Conclusions Additional techniques to account for sub-optimal linkage rates may be required to address potential biases resulting from this data linkage. Nonetheless, the linkage between administrative social assistance and health care data will provide important findings on the social determinants of health.

Introduction Probabilistic Record Linkage of large databases requires a substantial amount of time and resources, resulting in significant costs. In addition, the process is subject to error, particularly during manual grey area resolution of uncertain matched pairs. Objectives and Approach The objective of this semi-experimental desinged study was to compare the accuracy and efficiency of different record linkage approaches. Four different record linkage software packages were selected: AutoMatch, G-Link, SAS Data Quality (DataFlux) and LinxMart. A large data set with all required linkage variables (e.g., first and last name, date of birth and gender) and a common unique identifier with the ICES linkage spine (registry) was chosen to represent our ground truth. Four non-overlapping cohorts were randomly selected from this data source, representing small (n=10,000), medium (n=250,000) and large (n=5,000,000) data sets. Simulated errors were inserted into each cohort to represent a real linkage scenario. The smallest cohort was used to run a complete record linkage for each software package. Where the software allowed for manual grey area resolution, linkage was replicated by two different linkage analysts who were blinded to the simulated errors included in the data set. The time spent by each analyst on processing, programming and manual grey area resolution was recorded. The larger cohorts were used to measure accuracy and processing time taken by each of the software packages. In order to analyse possible errors, detailed output from each software package was generated to compare accepted and rejected pairs with our ground truth. Results This project is still ongoing. Evaluation of AutoMatch, G-Link and SAS Data Quality has largely been completed. The remaining analyses will be completed by August 2020. Conclusion / Implications The outcome of this project can inform the record linkage strategy at organizations and data centres such as ICES and help identify more efficient methods that preserve an acceptable level of accuracy for their needs.

Introduction The importance of Indigenous data sovereignty and Indigenous-led research processes is increasingly being recognized in Canada and internationally. For First Nations in Ontario, Canada, access to routinely-collected demographic and health systems data is critical to planning and measuring health status and outcomes in their populations. Linkage of this data with the Indian Register (IR), under First Nations data governance, has unlocked data for use by First Nations organizations and communities. Objectives To describe the linkage of the IR database to the Ontario Registered Persons Database (RPDB) within the context of Indigenous data sovereignty principles. Methods Deterministic and probabilistic record linkage methods were used to link the IR to the RPDB. There is no established population of First Nations people living in Ontario with which we could establish a linkage rate. Accordingly, several approaches were taken to determine a denominator that would represent the total population of First Nations we would hope to link to the RPDB. Results Overall, 201,678 individuals in the national IR database matched to Ontario health records by way of the RPDB, of which 98,562 were female and 103,116 were male. Of those First Nations individuals linked to the RPDB, 90.2% (n=181,915) lived in Ontario when they first registered with IR, or were affiliated with an Ontario First Nation Community. The proportion of registered First Nations people linking to the RPDB improved across time, from 62.8% in the 1960s to 94.5% in 2012. Conclusions This linkage of the IR and RPDB has resulted in the creation of the largest First Nations health research study cohort in Canada. The linked data are being used by First Nations communities to answer questions that ultimately promote wellbeing, effective policy, and healing.

ABSTRACT Objectives Ontario, the most populous province in Canada, has a universal healthcare system that routinely collects health administrative data on its 13 million legal residents that is used for health research. Record linkage has become a vital tool for this research by enriching this data with the Immigration, Refugees and Citizenship Canada (IRCC) Permanent Resident database and the Office of the Registrar General’s Vital Statistics-Death (VSD) registry. Our objectives were to estimate linkage rates and compare characteristics of individuals in the linked versus unlinked files. Approach We used both deterministic and probabilistic linkage methods to link the IRCC database (1985-2012) and VSD registry (1990-2012) to the Ontario’s Registered Persons Database. Linkage rates were estimated and standardized differences were used to assess differences in socio-demographic and other characteristics between the linked and unlinked records. Results The overall linkage rates for the IRCC database and VSD registry were 86.4% and 96.2%, respectively. The majority (68.2%) of the record linkages in IRCC were achieved after the three deterministic passes with the remaining 18.2% being linked probabilistically. Similarly the majority (79.8%) of the record linkages in the ORGD were linked using deterministic record linkage and the remaining 16.3% were linked after probabilistic and manual review. Unlinked and linked files were similar for most characteristics, such as age and marital status for IRCC and sex and most causes of death for VSD. However, lower linkage rates were observed among people born in East Asia (78%) in the IRCC database and certain causes of death in the VSD registry, namely perinatal conditions (61.3%) and congenital anomalies (81.3%). Conclusion The linkages of immigration and vital statistics data to existing population-based healthcare data in Ontario, Canada will enable many novel cross-sectional and longitudinal studies to be conducted. Analytic techniques to account for sub-optimal linkage rates may be required in studies of certain ethnic groups or certain causes of death among children and infants.

ABSTRACT Objectives Linkage of “big data” can provide the answers to a variety of health questions that benefit the delivery of patient care, impact of policies, system planning and evaluation. In some jurisdictions, legal and operational barriers may prevent data linkage for research and system evaluation. Collaboration between international research institutions in Canada, Australia and Wales was formed at the Farr Institute International Conference in 2015. This partnership will test privacy-preserving record linkage (PPRL) techniques for linkage accuracy on real datasets held in a Canadian data repository. Approach Bloom filter PPRL techniques have been incorporated into a prototype linkage system. Evaluations on probabilistic linkage using Bloom filters method have shown potential for large-scale record linkage, performing both accurately and efficiently under experimental conditions. The prototype will be used to evaluate the Bloom filter PPRL techniques in 3 phases. Phase 1: 3 tests using simulated data relating to 20 million individuals will be matched to a sub-cohort of 1 million individuals. Phase 2: 100,000 people from hospital inpatient records will be matched to 18 million people in a health system registration file. These tests will inform whether the method can achieve high levels of privacy protection without negatively impacting performance and linkage quality. Performance indicators include match rate and processing efficiency based on record volumes. Results Linkage quality will be assessed by the number of true matches and non matches identified as links and non-links. This method will be evaluated using synthetic and real-world datasets, where the true match status is known. Initial performance testing linked a file of 3,000 records to 30,000 with a 100% match result. Subsequent test phases as above will continue to be evaluated and these results will be presented. Conclusion Completion of the phased tests will confirm the ability to link datasets while preserving privacy. This international collaboration will expand the utility of this prototype linkage system and expand the global knowledge bank focusing on PPRL methods in general. It will also inform how to adapt to local requirements by providing a solution to many common legal and administrative challenges.

ABSTRACT Objectives A health services research organization in Toronto, Ontario, Canada conducts population-based research to improve the health of Canadians in seven main areas: (1) cancer, (2) cardiovascular disease, (3) chronic disease and pharmacology, (4) health system planning and evaluation, (5) kidney, dialysis and transplantation, (6) mental health and addictions, and (7) primary care and population health. The Information Management (IM) team within the Data Quality and Information Management (DQIM) department at our non-profit organization is an integral component for upholding privacy and confidentiality policies and procedures while facilitating quality research using different types of data such as health administrative, third-party, primary data collection, and electronic medical records (EMR). Methods The IM team is responsible for receiving data, encoding direct personal identifiers, screening for unnecessary identifiers, performing probabilistic data linkage when necessary, importing the data to the Research Analytics Environment (a client/server Linux-based system), and destroying the data according to the terms stipulated in the executed data sharing agreement. The purpose of the presentation is to detail the above steps of processing data to protect individuals’ identities yet preserve the usefulness of carrying out research. The presentation will include aspects from importing data into SAS to storage and encoding of personal identifiers to probabilistic data linkage, which involves maximizing linkage with other datasets at the organization. Linking data at the organization involves the encryption or encoding of health card numbers to “Key Numbers.” Results The processing practices used at the organization comply with Canadian privacy laws such as the Personal Health Information Protection Act (PHIPA) as well as organizational policies and Research Ethics Board approvals. The approaches used to conceal individual identities yet allow linkage to various data sources can be modelled by other health agencies, ministries, and non-health related organizations that work with sensitive data but face challenges in maintaining both privacy and research quality. Our organization strives to make processing as efficient as possible and create maximum linkability to the various data sources in house while upholding privacy and confidentiality.

We used record linkage to create a data repository of health information of persons who were federally incarcerated in Ontario and Canada. We obtained records from 56,867 adults who were federally incarcerated between January 1, 1998 and December 31, 2011 from the Correctional Service of Canada; 15,248 records belonged to individuals residing in Ontario, Canada. We linked these records to the Registered Persons Database (RPDB) which contained records from 18,116,996 individuals eligible for health care in Ontario. Out of 56,867 OMS records, 22,844 (40.2%) were linked to the RPDB. Looking only at those incarcerated in Ontario, 98%, (14 953 of 15248) records were linked to RPDB. Most records of persons in Ontario-based facilities were linked deterministically. Linkage rates were lower for women, minority groups, and substance users. In conclusion, record linkage enabled the creation of a valuable data repository: there are no electronic medical records for correctional populations in Canada, making it more difficult to profile their health.