The patient matching problem nobody budgets for

Read any health information exchange business case and you will find a line about connecting facilities, a line about standards, and silence on identity. Yet identity is the mechanism by which the whole thing delivers value: a longitudinal record exists only if you can decide, reliably, that this record and that record belong to the same person.

Why it is harder here

The matching literature assumes stable identifiers and consistent demographic capture. African primary care data frequently offers neither.

• Name order inverts between registrations, and spelling varies with the clerk transliterating it.
• Dates of birth are estimated, and 1 January is over-represented by an order of magnitude.
• Phone numbers are shared across a household, so a phone match can merge a mother and her son.
• National identifiers exist but coverage is partial, and partial coverage is the worst case: you get a strong signal for some records and must fall back to weak signals for the rest.

The two errors are not symmetrical

A missed match is an inconvenience: the clinician sees an incomplete history, which is the situation they are in today. A false match is a clinical safety event: one patient's allergies, results and medications appear under another's name. Design must be asymmetric — set thresholds so that ambiguity goes to human review rather than to an automatic merge, and make merges reversible with full lineage.

That single decision, made early, is the difference between an exchange clinicians trust and one they learn to work around.

What to budget

• A client registry with deterministic rules, probabilistic scoring, and configurable thresholds you expect to tune quarterly.
• A staffed review queue. Not a script — people, with a target turnaround and an escalation path for clinical ambiguity.
• Reversible merge and unmerge with a complete audit trail. You will need it in month two.
• Registration-side improvement: better capture at the front desk beats better matching at the back end, every time, and it is cheaper. Fix the form, constrain the fields, train the clerk.
• Measurement. Publish match rate, review queue depth and known false-match count as programme metrics. If nobody reports them, nobody owns them.

The organisational point

Identity sits between technology and operations, which in most programmes means it sits nowhere. It needs a named owner with authority over both the algorithm and the humans reviewing its output. Where I have seen exchanges work, that role existed from the start. Where I have seen them stall, identity was a workstream inside a technical team that had no mandate over registration practice in facilities.

Budget it explicitly, staff it permanently, and stop treating it as a matching algorithm. It is a clinical data safety function.