1、Designation: E 1714 07An American National StandardStandard Guide forProperties of a Universal Healthcare Identifier (UHID)1This standard is issued under the fixed designation E 1714; the number immediately following the designation indicates the year oforiginal adoption or, in the case of revision,
2、 the year of last revision. A number in parentheses indicates the year of last reapproval. Asuperscript epsilon (e) indicates an editorial change since the last revision or reapproval.1. Scope1.1 This guide covers a set of requirements outlining theproperties required to create a universal healthcar
3、e identifier(UHID) system. Use of the UHID is expected to initially befocused on the population of the United States but there is noinherent limitation on how widely these identifiers may beapplied.1.2 This guide sets forth the fundamental considerations fora UHID that can support at least four basi
4、c functions effec-tively:1.2.1 Positive identification of patients when clinical care isrendered;1.2.2 Automated linkage of various computer-based recordson the same patient for the creation of lifelong electronic healthcare files;1.2.3 Provision of a mechanism to support data security forthe protec
5、tion of privileged clinical information; and1.2.4 The use of technology for patient records handling tokeep health care operating costs at a minimum.1.3 This standard does not purport to address all of thesafety concerns, if any, associated with its use. It is theresponsibility of the user of this s
6、tandard to establish appro-priate safety and health practices and determine the applica-bility of regulatory limitations prior to use.2. Referenced Documents2.1 ASTM Standards:2E 1384 Practice for Content and Structure of the ElectronicHealth Record (EHR)E 2553 Guide for Implementation of a Voluntar
7、y UniversalHealthcare Identification System3. Terminology3.1 Definitions:3.1.1 clinical record linkageindividual unit records linkedfor the purpose of documenting the sequence of events or care,or both, for a specific patient.3.1.2 discriminating power of an identifierthe capabilityof an identifier
8、to reduce the possible global population to asmaller number. For example, sex identification reduces thepopulation size to approximately half. Date of birth reduces thepopulation size to approximately one of 25 000 in the UnitedStates. The smaller the population size covered by an identifier(that is
9、, the greater the discriminating power), the better thatidentifier is.3.1.3 encounteran instance of direct interaction, regard-less of the setting, between a patient and a practitioner vestedwith primary and autonomous responsibility for diagnosing,evaluating, treating, or some combination thereof,
10、the patientscondition or providing social worker services (See GuideE 1384). (Encounters do not include ancillary services, visits,or telephone contacts.)3.1.4 episode of carea chain of events over a period oftime during which clinical care is provided for an illness or aclinical problem (See Guide
11、E 1384).3.1.5 healthcare identifiera tag for the identification of anindividual created for exclusive use of the health care system.3.1.6 identifiera datum, or a group of data, that allowspositive recognition of a particular individual.3.1.7 management organizationan organization respon-sible for th
12、e management and oversight of the UHID systemand its operations.3.1.8 occasion of servicea specified identifiable instanceof an act of service involved in the care of patients orconsumers (See Guide E 1384).3.1.9 permanent identifiera characteristic feature of anindividual that generally does not ch
13、ange over time, such assex, date of birth, place of birth, or fingerprint.3.1.10 private universal health care identifier (PUHID) aUHID that has been encoded in order to disidentify the personassociated with that UHID.3.1.11 prospective record linkagesuccessive documenta-tion of clinical encounters
14、so that all records are linked duringthe process of care to ensure the continuity of patient care.Linkage is performed at the unit record level and occurs duringthe time the patient is receiving care. For electronic healthrecords, prospective record linkage involves linking all patient1This guide is
15、 under the jurisdiction of ASTM Committee E31 on HealthcareInformatics and is the direct responsibility of Subcommittee E31.25 on HealthcareData Management, Security, Confidentiality, and Privacy.Current edition approved Aug. 15, 2007. Published September 2007. Originallyapproved in 1995. Last previ
16、ous edition approved in 2000 as E 1714 00.2For referenced ASTM standards, visit the ASTM website, www.astm.org, orcontact ASTM Customer Service at serviceastm.org. For Annual Book of ASTMStandards volume information, refer to the standards Document Summary page onthe ASTM website.1Copyright ASTM Int
17、ernational, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959, United States.assessment, diagnostic, treatment, and other information col-lected by all care providers so that the information is availableat the time the patient is being treated. All records for anindividual patient
18、 will be linked accurately since errors will bediscovered and corrected in the process of providing care.3.1.12 retrospective record linkagematching unit recordsin data files not originally designed to be linked. The purposeof the linkage is to expand the comprehensiveness of each filebeing linked t
19、o facilitate evaluations of efficiency and effec-tiveness. Linkage can be performed manually using the actualpaper records if the files are small. Linkage is more efficient ifperformed probabilistically using computerized data if the filesare large and conditions of uncertainty exist concerning what
20、should be linked. (H. B. Newcombe was the pioneer developerof retrospective probabilistic record linkage.) Not part of theprocess of patient care, this linkage occurs some time after thepatient has been discharged and after the records have beencomputerized and merged into data files that may be man
21、agedat the facility, regional, or state level. Not all records thatshould link are expected to link because of missing orinaccurate data and missing records. Typical data files linkedretrospectively include birth and death certificates, diseaseregistries with hospital discharge records, emergency me
22、dicalservices (EMS) crash records, and hospital discharge recordsstatewide.3.1.13 temporary patient identifiera unique identifierused to serve as an interim identifier when an individualsUHID is not available. All information linked using thetemporary patient identifier is to be transferred to the a
23、ppro-priate UHID when the correct UHID becomes known.3.1.14 trusted authorityan organization that is able andauthorized to provide UHID services, such as granting newUHIDs and supporting UHID status validation services.3.1.15 universal healthcare identifier (UHID)a healthcareidentifier designed so t
24、hat a healthcare identifier can beassigned to every individual.3.1.16 universal healthcare identifier computer systemanautomated system that can perform the functions needed tosupport a UHID, for example, verifying the validity of a UHID.3.1.17 universal healthcare identifier systemthe agencies,syst
25、em, and networks that implement a UHID and conductassociated activities.3.1.18 variable identifierthose personal characteristicsthat may change over time such as home address, telephonenumber, insurance number, or name.3.1.19 visitthe visit of an outpatient to one or more unitsor facilities located
26、in or directed by the entity maintaining theoutpatient health services (such as a clinic, physicians office,hospital, or medical center) (See Guide E 1384). Visits providea count of the number of patients seen. It is possible for a singlepatient to have more than one encounter and more than oneoccas
27、ion of service during a visit.4. Significance and Use4.1 Recent experience with computer-based patient records(CPRs) has revealed many valuable potential benefits, but ithas also become apparent that the effective application of thistechnology creates some new problems. CPRs offer the optionfor life
28、long linkage of all records on a patient, from birth todeath. Such longitudinal record linkage would make thepatients entire past health history retrievable. This could makepossible a quantum leap in the clinical practice of health care,but a reliable patient identifier is essential to make large-sc
29、aleregional and nationwide record linkage feasible. The design ofa patient identifier system is not a simple task. Incorrect recordlinkage would create confusion, at least, or possibly causeserious consequences. To gain the benefits from such anidentifier, it must be used by all relevant organizatio
30、ns. Auniversal patient identifier system must resist unauthorizedaccess to confidential clinical data.Furthermore, the creation of personal identifiers for theentire population must be a cost-effective process in light ofongoing fiscal constraints. The creation and administration ofpersonal identifi
31、ers for the entire population must be accom-plished at a cost that is widely accepted as affordable andjustified. Last, but not least, a time pressure exists. The solutionto the patient identifier challenge should use technology tofacilitate rapid deployment of the system to permit the expe-ditious
32、implementation of CPRs. A companion document,Guide E 2553, provides the implementation strategy concern-ing how to actually implement the UHID system.5. Criteria and Characteristics of a Universal HealthCare Identifier5.1 The UHID should meet at least the following criteria(listed in alphabetical or
33、der):5.1.1 AccessibleNew UHIDs should be available when-ever and wherever they are required for assignment.5.1.2 AssignableIt should be possible to assign a UHID toan individual whenever it is needed. Assignment will beperformed by a UHID trusted authority after receiving aproperly authenticated req
34、uest for a new UHID.5.1.3 AtomicA UHID should be a single data item. Itshould not contain subelements that have meaning outside thecontext of the entire UHID. Nor should the UHID consist ofmultiple items that must be taken together to constitute anidentifier.5.1.4 ConciseThe UHID should be as short
35、as possible tominimize errors, the time required for use, and the storageneeded.5.1.5 Content-FreeThe UHID should not depend on pos-sibly changing or possibly unknown information pertaining tothe person.5.1.6 ControllableIt must be possible to ensure the con-fidentiality of PUHIDs. Only trusted auth
36、orities have access toalgorithms and methods used to link PUHIDs and UHIDs.5.1.7 Cost-EffectiveThe UHID system chosen shouldachieve maximum functionality while minimizing the invest-ment required to create and maintain it.5.1.8 DeployableThe UHID should be implementableusing a variety of technologie
37、s, including magnetic cards, barcode readers, optical cards, smart cards, audio, voice, computerdata files, and paper.5.1.9 DisidentifiableIt should be possible to create anarbitrary number of specialized UHIDs that can be used to linkhealth information concerning specific individuals but thatcannot
38、 be used to identify the associated individual. These areprivate universal healthcare identifiers (PUHIDs). With theE1714072exception of disidentification, PUHIDs should have all of theproperties attributable to UHIDs, including verification (see5.1.31). It should be clear to all users whether a spe
39、cificidentifier represents a UHID or a PUHID. The PUHID schemeshould be capable of generating a large number (at leasthundreds) of PUHIDs for a single individual (See Section 7).5.1.10 FocusedThe UHID system should be created andmaintained solely for the purpose of supporting health care. Itsform, u
40、sage, and policies should not be influenced by the needsor requirements of other activities.5.1.11 GovernedA management organization shall existthat is responsible for overseeing the UHID system. Thisagency will determine the policies that govern the UHIDsystem, manage the trusted authority(ies), an
41、d take suchactions as are necessary to ensure that the UHIDs (andPUHIDs) can be used properly and effectively to support healthcare.5.1.12 IdentifiableIt shall be possible to identify theperson associated with a valid UHID. Identifying informationmay include such standard items as name, birthdate, s
42、ex,address, mothers maiden name, etc. This information is notincorporated in the UHID but is associated with it by linkages.5.1.13 IncrementalThe UHID system should be capableof being implemented in a phased-in manner. This may includeincremental implementation for a specific institution (sometypes
43、of information linked using UHIDs and some using otheridentifiers), for the information on a specific patient, and for ageographic area.5.1.14 LinkableIt shall be possible to use the UHID, orPUHID, to link various health records together in both auto-mated and manual systems.5.1.15 LongevityThe UHID
44、 system should be designed tofunction for the foreseeable future. It should not contain knownlimitations that will force the system to be restructured orrevised radically.5.1.16 MappableDuring the incremental implementationof a UHID, it shall be possible to create bidirectional linkagesbetween a UHI
45、D and existing identifiers used currently by avariety of health care institutions.5.1.17 MergeableIn the (theoretically infrequent) casethat duplicate UHIDs are issued to a single individual, it shallbe possible to merge the two UHIDs to indicate that they bothapply to the same individual.5.1.18 Net
46、workedThe UHID should be supported by anetwork that makes UHID services universally available whereneeded.5.1.19 PermanentOnce assigned, a UHID should remainwith that individual. It should never be reassigned to anotherperson, even after the individuals death.5.1.20 PublicA UHID (but not a PUHID) is
47、 meant to bean open data item. The individual it identifies should be able toreveal it to any person or organization.5.1.21 Repository-BasedA secure, permanent repositoryshall exist in support of the UHID system. The repositoryshould contain UHIDs, PUHIDs, and other relevant informa-tion to support
48、the functions of the UHID system.5.1.22 RetirementIt shall be possible to retire a UHID orPUHID that is no longer active, for example, when theassociated individual has expired or if other circumstances (forexample, fraudulent use) indicate that the identifier must beretired.5.1.23 RetroactiveIt sha
49、ll be possible to assign UHIDs(and PUHIDs) to all of the currently existing individuals at thetime that the UHID system is implemented.5.1.24 SecureThe creation of PUHIDs, decryption of aPUHID to reveal the identity of the individual, and mainte-nance of privacy techniques must be performed in a securemanner to ensure that the policies governing such activities areenforced and that patient privacy is protected.5.1.25 SplittableIn the (theoretically never occurring)event that the same UHID is assigned to two individuals, theremust be a
