Category: Data & AI Infrastructure
The analyses that need connected patient data are exactly the ones that raise privacy stakes — and getting linkage wrong risks patients, partnerships, and regulatory standing all at once.
Connected patient data is the raw material of modern evidence generation, but connecting it is legally and ethically loaded: identifiers can't simply be shared between data partners, de-identified data must stay de-identified after linkage, and small cohorts can become re-identifiable when enough sources are joined. Organizations face the problem from both directions — needing to link external data they license, and needing to contribute or connect their own data without creating exposure. Privacy-preserving linkage infrastructure — tokenization services, de-identification pipelines, and governance tooling — makes the join possible without any party handling another's identified records.
The prevailing approach is tokenization: identifying fields are transformed, within each data holder's environment, into irreversible tokens through a common certified process, so records referring to the same person carry matching tokens while the identifiers themselves never travel. Datasets tokenized under the same scheme can then be joined on tokens alone, and the linked result goes through expert review to confirm the combination hasn't quietly re-created identifiability — the risk that grows as sources stack. The honest limits: token matching is imperfect (data-entry variation causes both missed and false matches, and vendors should quantify the rates), and tokenization only addresses identity — the governance questions of consent scope, permitted use, and downstream control remain, and remain the data holders' responsibility.
Certification and measurement first: which expert-determination or equivalent standard the de-identification and tokenization process meets, in which jurisdictions, and what the measured match accuracy is — a vendor should state false-match and missed-match rates rather than describing linkage as simply 'working'. Jurisdiction matters because privacy regimes differ materially in what de-identification requires and permits. Then the operational surface: how re-identification risk is reassessed as new sources are added to a linked asset, what happens with small or rare-disease cohorts where risk concentrates, and how permitted-use restrictions attach to and travel with the linked data. Governance that lives in contracts alone, with no technical enforcement, tends to drift.
Most organizations meet tokenization through a concrete project — licensing two datasets that need joining, or contributing data to a research collaboration — and the pragmatic path is to run that first linkage with established infrastructure rather than inventing an approach per project. The lasting work is internal: establishing who approves linkages, how re-identification risk is assessed and by whom, and which uses are in and out of scope — so that the second and tenth linkage inherit a process instead of re-litigating one.
No. Tokenization enables matching without shared identifiers, but the linked dataset can still be identifying in effect if it combines enough detail on few enough people. That is why serious workflows pair tokenization with expert re-identification risk assessment of the combined data — the token is a mechanism, not a guarantee.
Good enough for most research uses, but never perfect — variations in how names, dates, and addresses were recorded cause both missed links and false links. Credible vendors publish measured rates, and analysts should understand how linkage error propagates into their specific study design.
It depends on jurisdiction, data type, and the consent under which each source was collected — this is a legal determination, not a vendor feature. Infrastructure can enforce whatever scope has been established, but establishing the scope belongs to the data holders and their counsel.
Small populations concentrate re-identification risk: a linked record combining a rare diagnosis, a region, and a timeline can narrow to very few individuals even without identifiers. Rare-disease linkage warrants stricter risk review, coarser data granularity where feasible, and honest acknowledgment that some analyses may not be safely feasible at all.
Intercept Pharmaceuticals worked with Komodo Health to apply its Healthcare Map real-world data to primary biliary cholangitis, supporting patient-journey and treatment-pattern analyses for its Ocaliva franchise.
Vendor: Komodo Health · press release (Komodo Health (Business Wire)) · 2022-11-10 — Partner: Intercept Pharmaceuticals
Verana Health and the American Academy of Ophthalmology launched the Verana Research Network, an IRIS Registry initiative in which academic medical centers and ophthalmology practices use IRIS Registry data and Verana's platform to increase clinical trial access, accelerate recruitment, and advance ophthalmic research.
Vendor: Verana Health · press release (Verana Health) · 2022-12-07 — Partner: American Academy of Ophthalmology