Against Simple Universal Health-care Identifiers

Medical records are becoming fully computerized.’ Technical, administrative, and economic forces are pushing toward standardization on a single identi-fier, such as the Social Security number (SSN), to index all records. Consequently, the privacy and se-curity of our medical histories will be severely com-promised. We argue that there are sensible and ef-fective technologic means available to reduce the risks of such compromise, and that it is time to design the characteristics we want in our record-keeping sys-tems. Current Trends and Their Dangers Over a year ago, a meeting of the American College of Medical Informatics took up the question of how to identify patient records and concluded that the simplest, most expedient solution was to adopt the SSN (extended by a check digit) as the universal health-care identifier. ’ The advantages of this pro-posal are that virtually everyone already has an SSN and that an organization exists that issues new ones as needed. Recognized disadvantages include rela-tively frequent cases where more than one person was issued the same SSN, people with multiple SSNs, and newborns and “marginal ” people who have health care needs but no SSNs. Other potential problems include: eventual insufficiency of a nine-digit “ad-dressing ” scheme, lack of consistency checks leading to easy misidentification, and privacy considerations. Our major concerns grow mainly out of the consid-erations of privacy.