Artificial Intelligence Benchmarking of Distributed Clinical Record Linkage Under Unmeasured Facility Identifier Recycling: A Healthcare Privacy-Robustness Evaluation

Record linkage across distributed clinical repositories is routinely benchmarked as though facility identifiers were stable and unique, yet identifiers are recycled when facilities close, merge or are renumbered, and the recycling process is rarely observed. the present analysis formalises identifier recycling as an unmeasured contamination of the blocking and comparison space, and derives the consequences for privacy-robustness benchmarking of linkage algorithms. A contamination model is specified in which a fraction of records carry identifiers that have been reassigned to a different facility, and the resulting bias in estimated match weights, false-link rates and disclosure risk is derived analytically. Recycling produces a non-monotone bias in the false-link rate: small contamination can reduce measured false links while inflating true-link loss, so that benchmark rankings of linkage algorithms can reverse as contamination rises. A robustness envelope is defined and shown to be estimable from observable quantities under stated assumptions. The framework is illustrated with the DHS Program indicator 'Households possessing a computer' (HC_HEFF_H_CMP) across 27 African countries and 56 country-survey observations from 2015 to 2025, with mean 7.893 and standard deviation 5.144, to show how facility-level identifier instability would propagate into cross-survey linkage benchmarks. The contribution is a formal account of why privacy-robustness benchmarks for distributed clinical record linkage are not identifiable from linkage outputs alone when identifier recycling is unmeasured, together with a bounded robustness envelope that can be reported alongside conventional benchmark scores.