Master patient index and unique health identifiers: a guide
A master patient index (MPI) is the service that keeps one identity for each patient across the records of a facility, a network or a country. It assigns identifiers, matches new registrations against existing patients, links records that belong to the same person and flags likely duplicates for review. A unique health identifier, issued nationally or by the health system, makes matching more reliable, but no identifier removes the need for good registration practice and a sound matching process.
Every benefit attributed to an electronic health record depends on knowing whose record it is. A laboratory result filed against the wrong patient, an allergy recorded on a duplicate chart, or a referral that cannot be linked to the patient's history are identity failures before they are clinical ones. This guide explains how patient identity is managed, the scale of the problem, the standards involved, and what ministries and hospitals should require.
Why patient identity is a safety issue
WHO named patient identification as one of its nine patient safety solutions in 2007 [1]. The accompanying guidance states that failure to identify patients correctly continues to result in medication errors, transfusion errors and testing errors, as well as wrong person procedures and infants discharged to the wrong families [2]. It recommends the use of at least two identifiers, such as name and date of birth, at admission, transfer and before care is given, and states that neither identifier should be the patient's room number [2]. It also recommends standardised approaches across a health system, involving patients in confirming their identity, and, where feasible, automated tools such as electronic order entry, bar coding and biometrics [2].
These recommendations apply on paper as much as in software. What an EHR adds is the ability to enforce them consistently, and the risk that an identity error, once made, propagates to every department that uses the record.
The scale of the duplicate record problem
The most detailed public evidence comes from the United States, where the Office of the National Coordinator for Health Information Technology commissioned a review of patient identification and matching. The 2014 report cited a study of 112 master patient indexes that found a mean duplicate rate of 8 per cent, with a quarter exceeding 10 per cent; among eleven enterprise indexes, duplicate rates ranged from 7 to 39 per cent [3]. Health systems with tightly managed data quality programmes achieved match rates of 90 per cent or higher, but rates fell to roughly 50 to 60 per cent when records were shared across regions or with outside partners [3]. One health system estimated about US$60 in operational cost to resolve a single duplicate record [3].
The report identified the causes, and they are universal: typing errors, misspellings and transposed fields at registration; empty or false data; inconsistent formats for names, dates and addresses; registrar turnover and limited training; and multiple systems within one organisation [3].
In low and middle income countries, additional factors apply. Names may be recorded in different orders or spellings, dates of birth may be unknown or estimated, addresses may lack street names or numbers, and patients may attend several facilities with separate paper registers. A survey of public general hospitals in Nigeria's Federal Capital Territory found that 90.9 per cent assigned serial hospital numbers, that the national identification number was captured only as an optional field, and that fingerprint capture had not been activated in the electronic systems in use [4].
National identification and its limits
National identity programmes are expanding but remain incomplete. The World Bank's Identification for Development initiative estimated at the end of 2022 that just under 850 million people worldwide do not have an official identity document, mainly in low and lower middle income economies in sub Saharan Africa and South Asia [5]. More than half of those without proof of identity are children whose births were not registered, and in low income countries women are 8 percentage points less likely than men to have an ID [5].
Health specific identifiers can move faster. India's Ayushman Bharat Digital Mission reported 79.71 crore health accounts created, about 65.09 crore health records linked and about 4.17 lakh facilities registered as of July 2025 [6].
The lesson for ministries is that a health identifier is a powerful matching attribute, but not every patient will have one at every visit. Newborns, emergency admissions, unconscious patients and people without documents all need to be registered and treated. An identity strategy must work for them too.
How a master patient index works
The OpenHIE architecture defines the client registry as the component that manages the unique identities of people receiving care [7]. Its specification requires that the registry maintain a registry of patients and their demographics, assign a unique identifier to each patient, link registration entries created by demographic changes, data entry errors or missing information, and support patient linking and de duplication [8]. Recommended functions include configurable matching rules, manual review of uncertain matches, synchronisation of identifiers with the shared health record, and a full audit log of changes [8].
Matching approaches
| Approach | How it works | Strengths | Limitations |
|---|---|---|---|
| Deterministic | Exact match on selected fields or an identifier | Simple, predictable | Fails on spelling variation and missing data |
| Probabilistic | Weighted scores across several fields | Tolerates variation | Requires tuning and review of uncertain matches |
| Biometric | Fingerprint or other biometric template | Independent of names and documents | Hardware cost, enrolment failures, consent |
| Identifier based | National or health identifier | Highly reliable when present | Not every patient has or carries one |
Most effective systems combine these. A study at an HIV care facility in western Kenya found that fingerprint matching achieved 89.3 per cent sensitivity with a 0 per cent false acceptance rate, retrieved records in 3.2 seconds compared with 9.5 seconds for demographic search, and was accepted by 96.3 per cent of patients surveyed [9]. The same study reported a failure to enrol rate of 2.3 per cent [9], a reminder that biometrics supplements rather than replaces demographic matching.
The trade off every MPI must manage
Every matching threshold trades false positives against false negatives [3]. A threshold that is too loose merges two different people into one record, which is the more dangerous error. A threshold that is too strict creates duplicates. The safe design automatically links only certain matches and sends probable matches to a trained person for review.
Standards for identity exchange
When patient identity must be shared between systems, standards determine whether it can be.
- FHIR Patient $match. In FHIR R4, the $match operation sends patient details to a master patient index, which returns likely matching records ordered by score from 0 to 1, each with a match grade [10]. The operation can be restricted to certain matches only, and the specification notes that MPIs can operate at institutional, regional or national level [10].
- IHE PIX and PIXm. The IHE Patient Identifier Cross referencing profiles link identifiers for the same patient across identification domains. In the FHIR based PIXm profile, an identity source notifies a cross reference manager when a patient is added, revised, merged or removed [11].
- WHO classification. WHO's classification of digital health interventions lists verifying a person's unique identity and enrolling persons for health services as distinct functions under identification and registration of persons, alongside civil registration and vital statistics [12].
The OpenHIE community's 2023 meeting in Lilongwe, Malawi, brought together experience from twelve countries on patient identity management and reported common challenges: lack of connectivity, interoperability, poor data quality, high costs and linking newborn data [13]. Those challenges should shape requirements, which is why identity management is closely tied to designing health systems for unreliable connectivity.
What to require of an EHR
| Requirement | Purpose |
|---|---|
| Search before create at every registration point | Prevents duplicates at the source |
| At least two identifiers confirmed before care | Follows WHO patient identification guidance |
| Facility identifier assigned at first registration | Every patient is identifiable even without a national ID |
| National or health identifier recorded where available | Supports matching across facilities |
| Newborn registered at birth and linked to the mother | Closes the newborn identity gap |
| Probable duplicates sent for human review | Avoids unsafe automatic merges |
| Audited merge and unmerge | Allows correction and accountability |
| FHIR R4 Patient exchange | Connects to a national client registry |
Total cost of ownership should include the staff time to review duplicates and train registration staff, as set out in the total cost of ownership of an EHR.
How Moana manages patient identity
Moana is built on one record per patient across every department. When a patient is registered, they receive a Moana ID, and clinicians, nurses, pharmacy and laboratory staff find the patient by name or Moana ID within the same Moana EHR, rather than creating separate departmental records. The same identity carries through to MOANA LIS, where barcoded sample collection ties each specimen to the patient at the point of collection, and to the Moana Pharmacy Management System, where prescriptions are verified against the patient's allergies and current medications.
The newborn gap is addressed in maternal and child care. Birth registration in Moana creates the baby's own patient record and links it to the mother, so that APGAR scores, newborn and special care, immunisation and growth are recorded against the child from the first hours of life.
For exchange beyond the facility, Moana supports FHIR R4, SMART on FHIR app launch, FHIR bulk export and HL7 v2, as described on the interoperability page, so that patient records can be exchanged with a national client registry or shared health record. Role based access, audited break glass access and a full audit log record who viewed or changed a patient's record, and the organisation that collects the data owns it, as set out on the trust page.
Moana is designed for unreliable connectivity: registrations and clinical work are saved on the device and synchronised when the connection returns, and conflicting changes are held for review rather than silently overwritten. Moana is live across clinics in Pakistan, clinics in the South Pacific and India. At ANGAU Memorial Provincial Hospital in Lae, Papua New Guinea, registration and every department have been mapped and configured with their Officers in Charge, the Consultation Clinic is already live in the Moana system, and hospital go live is expected in the coming weeks.
Frequently asked questions
What is a master patient index?
A master patient index is the service that maintains a single identity for each patient across one or more systems. It assigns identifiers, matches new registrations to existing patients and links records that belong to the same person. In the OpenHIE architecture it is called the client registry [7][8].
What is a typical duplicate record rate?
A study of 112 master patient indexes cited by ONC found a mean duplicate rate of 8 per cent, with some enterprise indexes as high as 39 per cent [3]. Rates in a given health system depend on registration practice and matching design.
Do we need a national health ID before implementing an EHR?
No. An EHR should assign its own patient identifier at first registration and record a national or health identifier when one exists. Waiting for universal national ID coverage would delay care for the people least likely to have one [5].
Is biometric identification necessary?
It is useful where documents and names are unreliable, but it is not sufficient alone. Published results show high accuracy with a small share of patients who cannot be enrolled [9], so demographic matching and human review remain necessary.
How should duplicates be resolved?
Through a defined review process: probable matches are reviewed by trained staff, merges are audited and reversible, and the cause of each duplicate is fed back into registration training.
Sources
- WHO launches nine patient safety solutions, World Health Organization, 2007
- Patient safety solutions: patient identification, WHO Collaborating Centre for Patient Safety Solutions, 2007
- Patient identification and matching final report, Office of the National Coordinator for Health Information Technology, 2014
- Scaling up a decentralized offline patient ID generation and matching algorithm to accelerate universal health coverage, Frontiers in Digital Health, 2022
- 850 million people globally do not have ID: why this matters and what we can do about it, World Bank, 2023
- 79.71 crore ABHA accounts created, over 65 crore health records linked, Digital Health News, 2025
- OpenHIE architecture specification: overview of the architecture, OpenHIE, 2024
- OpenHIE client registry component specification, OpenHIE, 2024
- Implementation of fingerprint technology for unique patient matching and identification at an HIV care and treatment facility in western Kenya, Journal of Medical Internet Research, 2021
- FHIR R4 operation: Patient $match, HL7 International, 2019
- Patient Identifier Cross referencing for mobile (PIXm): ITI 104 transaction, IHE International, 2024
- Classification of digital interventions, services and applications in health, second edition, World Health Organization, 2023
- Patient identity management in the global health context, International Journal of Population Data Science, 2024
