{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T03:02:37Z","timestamp":1785380557731,"version":"3.55.0"},"reference-count":28,"publisher":"Oxford University Press (OUP)","issue":"2","license":[{"start":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T00:00:00Z","timestamp":1760659200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100000002","name":"NIH","doi-asserted-by":"publisher","award":["RM1HG009034"],"award-info":[{"award-number":["RM1HG009034"]}],"id":[{"id":"10.13039\/100000002","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,2,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:sec>\n                    <jats:title>Objective<\/jats:title>\n                    <jats:p>Privacy preserving record linkage (PPRL) refers to techniques used to identify which records refer to the same person across disparate datasets while safeguarding their identities. PPRL is increasingly relied upon to facilitate biomedical research. A common strategy encodes personally identifying information for comparison without disclosing underlying identifiers. As the scale of research datasets expands, it becomes crucial to reassess the privacy risks associated with these encodings. This paper highlights the potential re-identification risks of some of these encodings, demonstrating an attack that exploits encoding repetition across patients.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Materials and Methods<\/jats:title>\n                    <jats:p>The attack leverages repeated PPRL encoding values combined with common demographics shared during PPRL in the clear (e.g., 3-digit ZIP code) to distinguish encodings from one another and ultimately link them to identities in a reference dataset. Using US Census statistics and voter registries, we empirically estimate encodings\u2019 re-identification risk against such an attack, while varying multiple factors that influence the risk.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>Re-identification risk for PPRL encodings increases with population size, number of distinct encodings per patient, and amount of demographic information available. Commonly used encodings typically grow from &amp;lt;1% re-identification rate for datasets under one million individuals to 10%-20% for 250 million individuals.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Discussion and Conclusion<\/jats:title>\n                    <jats:p>Re-identification risk often remains low in smaller populations, but increases significantly at the larger scales increasingly encountered today. These risks are common in many PPRL implementations, although, as our work shows, they are avoidable. Choosing better tokens or matching tokens through a third party without the underlying demographics effectively eliminates these risks.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.1093\/jamia\/ocaf183","type":"journal-article","created":{"date-parts":[[2025,10,4]],"date-time":"2025-10-04T11:50:52Z","timestamp":1759578652000},"page":"336-346","source":"Crossref","is-referenced-by-count":4,"title":["Re-identification risk for common privacy preserving patient matching strategies when shared with de-identified demographics"],"prefix":"10.1093","volume":"33","author":[{"given":"Austin","family":"Eliazar","sequence":"first","affiliation":[{"name":"HealthVerity Inc. , Philadelphia, PA 19103,","place":["United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"James Thomas","family":"Brown","sequence":"additional","affiliation":[{"name":"HealthVerity Inc. , Philadelphia, PA 19103,","place":["United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sara","family":"Cinamon","sequence":"additional","affiliation":[{"name":"HealthVerity Inc. , Philadelphia, PA 19103,","place":["United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9795-9063","authenticated-orcid":false,"given":"Murat","family":"Kantarcioglu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Virginia Tech , Blacksburg, VA 24061,","place":["United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bradley","family":"Malin","sequence":"additional","affiliation":[{"name":"Department of Biomedical Informatics, School of Medicine, Vanderbilt University Medical Center , Nashville, TN 37235,","place":["United States"]},{"name":"Department of Biostatistics, School of Medicine, Vanderbilt University Medical Center , Nashville, TN 37235,","place":["United States"]},{"name":"Department of Computer Science, School of Engineering, Vanderbilt University , Nashville, TN 37235,","place":["United States"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2025,10,17]]},"reference":[{"key":"2026012716161990300_ocaf183-B1","first-page":"160","year":"2002"},{"key":"2026012716161990300_ocaf183-B2","doi-asserted-by":"crossref","first-page":"4966","DOI":"10.1109\/TIFS.2021.3114026","article-title":"Modern privacy-preserving record linkage techniques: an overview","volume":"16","author":"Gkoulalas-Divanis","year":"2021","journal-title":"IEEE TransInformForensic Secur"},{"key":"2026012716161990300_ocaf183-B3","doi-asserted-by":"crossref","first-page":"1072","DOI":"10.1093\/jamia\/ocv038","article-title":"Design and implementation of a privacy preserving electronic health record linkage tool in Chicago","volume":"22","author":"Kho","year":"2015","journal-title":"J Am Med Inform Assoc."},{"key":"2026012716161990300_ocaf183-B4","doi-asserted-by":"crossref","first-page":"562","DOI":"10.1093\/jamiaopen\/ooz050","article-title":"Implementing a hash-based privacy-preserving record linkage tool in the OneFlorida clinical research network","volume":"2","author":"Bian","year":"2019","journal-title":"JAMIA Open."},{"key":"2026012716161990300_ocaf183-B5","doi-asserted-by":"crossref","first-page":"e10404","DOI":"10.1002\/lrh2.10404","article-title":"Privacy-preserving record linkage across disparate institutions and datasets to enable a learning health system: the national COVID cohort collaborative (N3C) experience","volume":"8","author":"Tachinardi","year":"2024","journal-title":"Learn Health Syst"},{"key":"2026012716161990300_ocaf183-B6","doi-asserted-by":"crossref","first-page":"346","DOI":"10.1109\/JBHI.2018.2796941","article-title":"On the accuracy and scalability of probabilistic data linkage over the Brazilian 114 million cohort","volume":"22","author":"Pita","year":"2018","journal-title":"IEEE J Biomed Health Inform"},{"key":"2026012716161990300_ocaf183-B7","first-page":"232","author":"Schnell","year":"2015"},{"key":"2026012716161990300_ocaf183-B8","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1186\/s12911-021-01393-1","article-title":"Linkage of Australian national registry data using a statistical linkage key","volume":"21","author":"Coulson","year":"2021","journal-title":"BMC Med Inform Decis Mak"},{"key":"2026012716161990300_ocaf183-B9","first-page":"281","article-title":"Evaluation of the encryption procedure and record linkage in the Belgian National Cancer Registry","volume":"58","author":"Van Eycken","year":"2000","journal-title":"Arch Public Health"},{"key":"2026012716161990300_ocaf183-B10","author":"Carduus"},{"key":"2026012716161990300_ocaf183-B11","doi-asserted-by":"crossref","first-page":"1826","DOI":"10.14778\/3352063.3352076","article-title":"Primat: a toolbox for fast privacy-preserving matching","volume":"12","author":"Franke","year":"2019","journal-title":"Proc VLDB Endow"},{"key":"2026012716161990300_ocaf183-B12","first-page":"197","author":"Karakasidis","year":"2015"},{"key":"2026012716161990300_ocaf183-B13","author":"Howe","year":"2023"},{"key":"2026012716161990300_ocaf183-B14","doi-asserted-by":"publisher","DOI":"10.29012\/jpc.764","article-title":"A taxonomy of attacks on privacy-preserving record linkage","volume":"12","author":"Vidanage","year":"2022","journal-title":"J Priv Confidentiality"},{"key":"2026012716161990300_ocaf183-B15","first-page":"1345","article-title":"A privacy attack on multiple dynamic match-key based privacy-preserving record linkage","volume":"5","author":"Vidanage","year":"2020","journal-title":"Int J Popul Data Sci"},{"key":"2026012716161990300_ocaf183-B16","doi-asserted-by":"crossref","first-page":"2956","DOI":"10.1109\/TKDE.2013.91","article-title":"Composite bloom filters for secure record linkage","volume":"26","author":"Durham","year":"2014","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"2026012716161990300_ocaf183-B17","first-page":"1094","article-title":"Privacy preserving linkage using multiple match-keys","volume":"4","author":"Randall","year":"2019","journal-title":"Int J Popul Data Sci"},{"key":"2026012716161990300_ocaf183-B18","doi-asserted-by":"crossref","first-page":"ooaf002","DOI":"10.1093\/jamiaopen\/ooaf002","article-title":"Accuracy of privacy preserving record linkage for real world data in the United States: a systemic review","volume":"8","author":"Tyagi","year":"2025","journal-title":"JAMIA Open."},{"key":"2026012716161990300_ocaf183-B19","doi-asserted-by":"crossref","first-page":"169","DOI":"10.1136\/jamia.2009.000026","article-title":"Evaluating re-identification risks with respect to the HIPAA privacy rule","volume":"17","author":"Benitez","year":"2010","journal-title":"J Am Med Inform Assoc"},{"key":"2026012716161990300_ocaf183-B20","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/1472-6947-12-66","article-title":"Estimating the re-identification risk of clinical data sets","volume":"12","author":"Dankar","year":"2012","journal-title":"BMC Med Inform Decis Mak"},{"key":"2026012716161990300_ocaf183-B21","first-page":"2017082801","article-title":"Re-identification risks in HIPAA safe harbor data: a study of data from one environmental health study","volume":"2017","author":"Sweeney","year":"2017","journal-title":"Technol Sci"},{"key":"2026012716161990300_ocaf183-B22","doi-asserted-by":"publisher","author":"Culnane","year":"2017","DOI":"10.48550\/arXiv.1712.05627"},{"key":"2026012716161990300_ocaf183-B23","first-page":"6","article-title":"Assessing and minimizing re-identification risk in research data derived from health care records","volume":"7","author":"Simon","year":"2019","journal-title":"EGEMS (Wash DC)"},{"key":"2026012716161990300_ocaf183-B24","doi-asserted-by":"publisher","first-page":"226","DOI":"10.1007\/978-3-642-22263-4_13","volume-title":"Privacy Enhancing Technologies","author":"Kuzu","year":"2011"},{"key":"2026012716161990300_ocaf183-B25","doi-asserted-by":"crossref","first-page":"285","DOI":"10.1136\/amiajnl-2012-000917","article-title":"A practical approach to achieve private medical record linkage in light of public resources","volume":"20","author":"Kuzu","year":"2013","journal-title":"J Am Med Inform Assoc."},{"key":"2026012716161990300_ocaf183-B26","doi-asserted-by":"crossref","first-page":"2605","DOI":"10.1093\/jamia\/ocae196","article-title":"Privacy preserving record linkage for public health action: opportunities and challenges","volume":"31","author":"Pathak","year":"2024","journal-title":"J Am Med Inform Assoc."},{"key":"2026012716161990300_ocaf183-B27","doi-asserted-by":"publisher","first-page":"447","DOI":"10.1093\/jamia\/ocac229","article-title":"Assessing the impact of privacy-preserving record linkage on record overlap and patient demographic and clinical characteristics in PCORnet\u00ae, the National Patient-Centered Clinical Research Network","volume":"30","author":"Marsolo","year":"2023","journal-title":"J Am Med Inform Assoc"},{"key":"2026012716161990300_ocaf183-B28","doi-asserted-by":"crossref","first-page":"e0314486","DOI":"10.1371\/journal.pone.0314486","article-title":"Secure privacy-preserving record linkage system from re-identification attack","volume":"20","author":"Lee","year":"2025","journal-title":"PLoS One."}],"container-title":["Journal of the American Medical Informatics Association"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/jamia\/article-pdf\/33\/2\/336\/64739937\/ocaf183.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/jamia\/article-pdf\/33\/2\/336\/64739937\/ocaf183.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,27]],"date-time":"2026-01-27T21:16:27Z","timestamp":1769548587000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/jamia\/article\/33\/2\/336\/8292788"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,17]]},"references-count":28,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2025,10,17]]},"published-print":{"date-parts":[[2026,2,1]]}},"URL":"https:\/\/doi.org\/10.1093\/jamia\/ocaf183","relation":{},"ISSN":["1067-5027","1527-974X"],"issn-type":[{"value":"1067-5027","type":"print"},{"value":"1527-974X","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2026,2]]},"published":{"date-parts":[[2025,10,17]]}}}