14.2 Data Stewardship & Master Patient Index (MPI) Management

Data Stewardship & Master Patient Index (MPI) Management

Accurate patient identification is the bedrock of patient safety, clinical care coordination, revenue cycle integrity, and healthcare analytics. In modern healthcare environments characterized by multi-facility health systems, disparate Electronic Health Record (EHR) systems, and regional Health Information Exchanges (HIEs), linking clinical data to the correct individual is a profound operational challenge. The Master Patient Index (MPI) and Enterprise Master Patient Index (EMPI) serve as the central identity registry. Health data analysts and data stewards must understand the taxonomy of patient identity errors, the mathematical algorithms governing patient matching, and the stewardship workflows required to maintain enterprise data integrity.

---

1. The Role of the Healthcare Data Steward

Data Stewards are the operational guardians of healthcare data assets. While governance committees establish overarching policies, data stewards execute day-to-day governance activities within their respective business and clinical domains.

+---------------------------------------------------------------------------------------------------+
|                             HEALTHCARE DATA STEWARDSHIP TAXONOMY                                  |
+-----------------------------------+-----------------------------------+---------------------------+
| BUSINESS / CLINICAL STEWARD       | TECHNICAL DATA STEWARD (CUSTODIAN)| DOMAIN DATA STEWARD       |
| - HIM Professionals, Informaticists| - Data Engineers, Database Admins | - Senior Domain Leader    |
| - Define business terms & metrics | - Manage physical schemas & DDL   | - Cross-departmental scope|
| - Author data quality validation  | - Maintain ETL data pipelines     | - Oversees all sub-domain |
| - Triage clinical data defects    | - Enforce technical constraints   |   stewards (e.g., Pharmacy|
| - Adjudicate identity review queue| - Monitor pipeline performance    |   or Laboratory Domain)   |
+-----------------------------------+-----------------------------------+---------------------------+

Core Responsibilities of Healthcare Data Stewards

1. Data Definition & Metadata Authoring: Formulating clear, unambiguous business definitions for data elements, documenting permissible value sets, and maintaining data dictionary entries.
2. Data Quality Profiling & Monitoring: Continuously profiling operational data against six foundational dimensions of data quality:
   • Completeness: Absence of missing values in mandatory clinical/demographic fields.
   • Accuracy: Closeness of recorded data values to the true real-world clinical state.
   • Validity: Adherence of data values to pre-specified formats, coding schemes, and ranges.
   • Consistency: Absence of contradictory data values across systems and records.
   • Timeliness: Availability of data within the clinically required timeframe.
   • Uniqueness: Absence of redundant records representing the same real-world entity.
3. Issue Remediation & Defect Triage: Managing data defect logs, performing root-cause analysis on recurring data quality failures, and coordinating workflow corrections with front-end clinical staff.
4. Master Data & Identity Adjudication: Reviewing probabilistic matching exception queues in the EMPI, conducting manual chart reviews, and executing merge or unmerge operations.

---

2. Master Patient Index (MPI) & Enterprise Master Patient Index (EMPI)

MPI vs. EMPI Architecture

• Master Patient Index (MPI): A database that maintains a permanent, unique demographic and identification record for every patient registered at a single healthcare facility or single EHR instance. It assigns a unique local Medical Record Number (MRN).
• Enterprise Master Patient Index (EMPI): An enterprise-level master data management database that spans an entire Integrated Delivery Network (IDN), multi-hospital system, or Health Information Exchange (HIE). The EMPI ingests demographic streams from multiple disparate facilities, outpatient clinics, and ancillary departmental systems (radiology, pharmacy, laboratory), creates a global Enterprise Master Person Index ID (EMPI ID), and maps all local facility MRNs to that single enterprise identifier.

+---------------------------------------------------------------------------------------------------+
|                                   ENTERPRISE MPI (EMPI) ARCHITECTURE                              |
+---------------------------------------------------------------------------------------------------+
  [ Hospital A (Epic) ]           [ Hospital B (Cerner) ]          [ Ambulatory Clinic (Athena) ]
     Local MRN: 104822               Local MRN: C-99481                  Local MRN: ATH-5501
            │                               │                                    │
            │ (HL7 ADT Feed)                │ (HL7 ADT Feed)                     │ (HL7 ADT Feed)
            ▼                               ▼                                    ▼
  ┌─────────────────────────────────────────────────────────────────────────────────────────────┐
  │                       ENTERPRISE MASTER PATIENT INDEX (EMPI) ENGINE                         │
  │  - Normalization & Standardization (Name parsing, Soundex, Address scrubbing)               │
  │  - Deterministic & Probabilistic Matching Algorithms (Fellegi-Sunter)                       │
  │                                                                                             │
  │  [ GLOBAL ENTERPRISE ID: EMPI-8830192 ]                                                     │
  │    ├── Mapped Local Identifier: Hospital A -> MRN 104822                                    │
  │    ├── Mapped Local Identifier: Hospital B -> MRN C-99481                                   │
  │    └── Mapped Local Identifier: Ambulatory Clinic -> MRN ATH-5501                           │
  └─────────────────────────────────────────────────────────────────────────────────────────────┘

Causes of Patient Identification Errors

Patient identification errors stem from front-end registration challenges and data variations:

• Demographic Variations: Name changes due to marriage/divorce, hyphenated surnames, non-traditional cultural naming conventions, and common nicknames (e.g., "Bill" vs. "William").
• Typographical Errors: Inverted numerals in Social Security Numbers or dates of birth (e.g., entering 04/12/1980 instead of 12/04/1980).
• Registration Pressures: Fast-paced emergency department registrations where incomplete or "John Doe" placeholder records are created and improperly reconciled.
• Newborn Records: Newborns initially registered under generic placeholders (e.g., "Babyboy Smith") whose charts are never formally linked to their permanent names.
• Address Instability: Highly mobile or unhoused patient populations with frequently changing or missing residential addresses.

Clinical and Financial Costs of Identity Errors

• Clinical Safety Risks: When medical records are fragmented, treating clinicians cannot access prior medication lists, severe allergy alerts, recent diagnostic imaging, or surgical history. This leads to medication errors, duplicate blood transfusions, adverse drug interactions, and clinical misdiagnoses.
• Financial Costs: Unnecessary duplication of diagnostic tests (e.g., repeating an MRI or CT scan performed yesterday at an affiliated clinic costs hundreds to thousands of dollars), delayed billing, rejected claims due to demographic mismatches, and administrative labor spent manually cleaning corrupt records.
• Legal & Regulatory Risks: HIPAA privacy violations resulting from delivering protected medical records to the wrong patient, and potential medical malpractice liability from misidentified surgical interventions.

---

3. Taxonomy of Patient Identity Discrepancies

The CHDA examination heavily tests the specific terminology used to classify patient identity failures in MPI and EMPI systems. There are three distinct discrepancy types:

+---------------------------------------------------------------------------------------------------+
|                             PATIENT IDENTITY DISCREPANCY TAXONOMY                                 |
+-----------------------------------+-----------------------------------+---------------------------+
| DUPLICATE RECORD                  | OVERLAY (CRITICAL SAFETY EVENT)   | OVERLAP RECORD            |
| - One Patient -> Multiple MRNs    | - Multiple Patients -> One MRN    | - One Patient -> Multiple |
| - Cause: Failing to find existing | - Cause: Wrong chart selected     |   Facilities Unlinked     |
|   record during registration      |   during registration/charting    | - Cause: Disparate EHRs   |
| - Result: Fragmented clinical     | - Result: Mixed medical charts;   |   in an IDN failing to    |
|   history across separate charts  |   catastrophic clinical danger    |   link local MRNs to EMPI |
+-----------------------------------+-----------------------------------+---------------------------+

1. Duplicate Record

• Definition: Occurs when one individual patient is assigned two or more distinct Medical Record Numbers (MRNs) within the same hospital or healthcare system.
• Clinical Scenario: Jane Doe is registered under MRN 10110 in 2022. In 2025, she visits the Emergency Department after changing her last name to Jane Smith. The registrar fails to perform an alias search and creates MRN 20550. Jane now has two distinct records in the same hospital.
• Consequence: Clinical information is fragmented. Her penicillin allergy recorded in MRN 10110 is invisible to the physician viewing MRN 20550.

2. Overlay (The Most Severe Clinical Safety Hazard)

• Definition: Occurs when two distinct, unrelated patients are incorrectly merged under a single MRN, or when a registrar/clinician mistakenly documents one patient's clinical care inside another patient's existing chart.
• Clinical Scenario: A registrar searches for "Robert Johnson, DOB 05/12/1975" and accidentally selects the chart of "Robert Johnson, DOB 05/12/1974" (MRN 77889). The clinical notes, blood type results, and medication orders for the first Robert Johnson are permanently saved into the second Robert Johnson's chart.
• Consequence: A catastrophic clinical hazard. Patient B's chart now contains Patient A's medical history, leading to wrong-patient drug administrations, incorrect blood transfusions, inaccurate clinical diagnoses, and severe HIPAA disclosure violations.

3. Overlap Record

• Definition: Occurs when a single patient has established medical records under different local facility identifiers across multiple discrete facilities or entities within an Integrated Delivery Network (IDN), but the central EMPI has failed to link these local identifiers to a single enterprise record.
• Clinical Scenario: Michael Brown has MRN A-123 at Suburban Community Hospital and MRN B-987 at Downtown Academic Medical Center (both owned by the same health system). Because the EMPI algorithm failed to match the records, the two hospital charts exist in isolation.
• Consequence: Care continuity across the integrated health system is broken. Specialists at the academic center cannot see outpatient laboratory work or diagnostic images captured at the community hospital, resulting in duplicated testing and fragmented care.

---

4. Identity Matching Methodologies & Algorithms

EMPI software engines utilize sophisticated mathematical algorithms to evaluate demographic attributes (First Name, Last Name, Middle Initial, Date of Birth, Gender, Social Security Number, Street Address, Zip Code, Phone Number) to determine if two incoming records represent the same human being.

+---------------------------------------------------------------------------------------------------+
|                             DETERMINISTIC vs. PROBABILISTIC MATCHING                              |
+-------------------------------------------------+-------------------------------------------------+
| DETERMINISTIC MATCHING (Rule-Based)             | PROBABILISTIC MATCHING (Fellegi-Sunter)         |
| - Logic: Binary exact-match rules (AND/OR)      | - Logic: Statistical weights based on entropy   |
| - Flexibility: Inflexible; zero error tolerance | - Flexibility: Tolerates typos, nicknames, noise|
| - Scoring: Binary (Match / No Match)            | - Scoring: Continuous numerical score (e.g. 0-100)
| - Precision: High (Low False Positives)         | - Optimization: Calibrated to minimize error    |
| - Recall: Low (High False Negatives/Duplicates) | - Thresholds: Auto-Match, Review, Non-Match     |
+-------------------------------------------------+-------------------------------------------------+

1. Deterministic Matching (Rule-Based Matching)

Deterministic matching evaluates demographic data against predefined, rigid Boolean rules.

• Example Rule Set:
  • Rule 1: Exact Match on (SSN + Date of Birth + First 3 letters of Last Name).
  • Rule 2: Exact Match on (First Name + Last Name + Date of Birth + Gender + Zip Code).
• Characteristics: If every specified field in a rule matches exactly, the records are classified as a match. If a single character differs (e.g., a transposed digit in an SSN or a maiden name), the rule fails completely.
• Strengths: High precision (extremely low false-positive rate); fast execution speed; easy for non-technical stakeholders to understand and audit.
• Weaknesses: High false-negative rate; fails to match records containing minor typos, hyphenated names, name changes, or missing SSNs.

2. Probabilistic Matching (The Fellegi-Sunter Methodology)

Developed by Ivan Fellegi and Alan Sunter (1969), probabilistic matching is the mathematical gold standard for enterprise record linkage. Instead of binary rules, the algorithm assigns positive agreement weights and negative disagreement weights to individual demographic fields based on their statistical discriminatory power (entropy) and error rates.

Mathematical Framework

For each demographic field $i$:

• $m_i = P(\text{Field } i \text{ agrees} \mid \text{Records represent the SAME person})$ (Reliability / completeness of field)
• $u_i = P(\text{Field } i \text{ agrees} \mid \text{Records represent DIFFERENT persons})$ (Probability of chance agreement by random coincidence)

$\text{Agreement Weight } (w_i^+) = \log_2 \left( \frac{m_i}{u_i} \right)$ $\text{Disagreement Weight } (w_i^-) = \log_2 \left( \frac{1 - m_i}{1 - u_i} \right)$

• Field Weight Variation (Discriminatory Power): Agreement on a demographic attribute with high entropy (such as a full 9-digit SSN or a rare surname like "Venkataraman") yields a very large positive weight. Agreement on an attribute with low entropy (such as Gender = Female, where $u_i \approx 0.50$) yields a very small positive weight.
• String Distance & Phonetic Algorithms: Modern probabilistic engines integrate string similarity algorithms to award partial agreement weights:
  • Levenshtein Distance: Measures the minimum number of single-character edits (insertions, deletions, substitutions) required to transform one string into another.
  • Jaro-Winkler Distance: Measures string similarity with a heavy weighting adjustment for matching prefix characters (ideal for comparing first and last names).
  • Soundex / Metaphone: Phonetic indexing algorithms that encode words by their English pronunciation, allowing "Smith" and "Smyth" to match successfully.

Three-Tier Threshold Scoring Architecture

The sum of all field weights produces a cumulative match score evaluated against two established thresholds:

+---------------------------------------------------------------------------------------------------+
|                               THREE-TIER EMPI SCORING THRESHOLDS                                  |
+---------------------------------------------------------------------------------------------------+
  Match Score: 0 ----------------- [ Non-Match Cutoff ] --------- [ Auto-Merge Cutoff ] -------- 100
                                           │                              │
       [ ZONE 1: NON-MATCH ]               │   [ ZONE 2: MANUAL REVIEW ]  │    [ ZONE 3: AUTO-MATCH ]
       - Score < Low Threshold             │   - Low <= Score < High      │    - Score >= High Threshold
       - System creates NEW unique MRN     │   - Routed to HIM Stewards   │    - System automatically links
       - Records classified as distinct    │   - Manual chart inspection  │      records to same EMPI ID

1. Auto-Match Threshold (e.g., Score $\ge 85$): High-confidence match. The EMPI automatically merges or links the records to the same Enterprise ID without human intervention.
2. Manual Review Queue / Potential Match Threshold (e.g., $65 \le \text{Score} < 85$): Ambiguous match. The records share significant commonalities (e.g., same DOB, address, and phone, but different first names: "Robert" vs. "Bob"). The EMPI routes the pair to the HIM Data Stewardship work queue for manual review.
3. Non-Match Threshold (e.g., Score $< 65$): Low-confidence score. The system classifies the record as a distinct individual and generates a new unique MRN/EMPI ID.

3. Referential Matching

Referential matching is an advanced paradigm that matches incoming clinical records against an external, curated demographic reference database spanning the entire national population (compiled from credit bureaus, public records, utilities, and postal records spanning 30+ years). Instead of comparing Record A directly to Record B, both records are compared to the comprehensive external reference graph. This allows the system to instantly resolve complex matches—such as recognizing that Jane Doe living in Chicago in 2018 is the exact same individual as Jane Smith living in Dallas in 2025, even if no single EHR record contains both addresses and names.

---

5. Operational Stewardship: MPI Remediation & Prevention Workflows

Maintaining a clean EMPI requires combining upstream front-end prevention with rigorous downstream back-end stewardship workflows.

Front-End Prevention Strategies at Patient Registration

• Algorithm-Assisted Search: Enforcing mandatory multi-attribute search protocols at registration (requiring registrars to input at least three demographic criteria before creating a new record).
• Real-Time Duplicate Alerts: Displaying potential duplicate match warnings to registration staff before a new MRN can be generated.
• Demographic Verification Technology: Scanning government photo IDs (driver's licenses) and insurance cards directly into the EHR with automated optical character recognition (OCR) and electronic insurance eligibility (EDI 270/271) cross-checks.

Back-End Data Stewardship & Queue Triage Protocols

When ambiguous matches enter the manual review queue, HIM Data Stewards follow standardized investigative protocols:

1. Demographic Cross-Referencing: Comparing historical addresses, past phone numbers, emergency contact names, and insurance policy/subscriber IDs.
2. Clinical Chart Comparison: Comparing primary care physician assignments, historical surgical scars/allergies, and previous admission dates.
3. Patient Contact / Identity Verification: Contacting the patient directly or requesting primary identity documentation when clinical data remains indeterminate.

Mechanics of Merging and Unmerging Records

+---------------------------------------------------------------------------------------------------+
|                                 RECORD MERGE vs. UNMERGE WORKFLOWS                                |
+-------------------------------------------------+-------------------------------------------------+
| MERGE OPERATION (Resolving Duplicates)          | UNMERGE OPERATION (Remediating Overlays)        |
| - Select "Surviving" (Primary) MRN              | - Sever corrupted master linkage immediately    |
| - Re-point child encounter records, clinical    | - Clinical audit of EVERY note, order & lab     |
|   notes, orders, flowsheets to Surviving MRN    | - Manually move misplaced encounters to correct |
| - Retire duplicate MRN (mark inactive/alias)    |   patient's true MRN                            |
| - Broadcast HL7 ADT^A40 (Merge) message to      | - Issue amended clinical reports & notify MDs   |
|   all downstream ancillary systems              | - Conduct formal HIPAA breach risk assessment   |
+-------------------------------------------------+-------------------------------------------------+

• The Merge Workflow: When two duplicate records (MRN 101 and MRN 202) are confirmed to represent the same patient, the steward selects the surviving (primary) MRN (typically the older record or the record with the most comprehensive clinical history). The system updates the master database pointer, transferring all historical encounters, clinical notes, laboratory results, and billing accounts to the surviving MRN. The retired MRN is flagged as an inactive alias. Crucially, the EMPI broadcasts an HL7 v2 ADT^A40 (Merge Patient Information) transaction message to all downstream departmental systems (LIS, PACS, Pharmacy, Billing) to ensure enterprise-wide synchronization.
• The Unmerge Workflow (Overlay Remediation): Unmerging is one of the most complex and legally sensitive procedures in health informatics. When an overlay is discovered, the HIM steward and clinical risk management team must immediately lock both records to prevent further clinical charting. A multidisciplinary clinical audit team meticulously examines every individual progress note, lab result, medication administration, and diagnostic image captured during the corrupted period to determine which patient it belongs to. Misplaced encounters are excised and transferred to the correct patient's chart. Amended clinical summaries are issued, treating physicians are formally alerted to potential clinical errors, and the compliance officer conducts a HIPAA breach risk assessment.

---

6. Master Comparison Table: MPI Discrepancy Types & Remediation