Multi-source longitudinal patient-level data encryption process

A system for longitudinally-linking individual patient healthcare transaction data records obtained from multiple data suppliers, the system comprising:

• at a central facility (LDF), a first component configured to:
• receive data records including at least one patient non-identifying attribute and at least one individually, doubly encrypted patient-identifying attribute encrypted with a first encryption key specific to an LDF and further encrypted with a second encryption key unique to a data source so that original unencrypted patient identification information in the at least one patient-identifying attribute remains secret with respect to other data sources;
• partially decrypt the received data records using a decryption key complementary to the second encryption key so that the at least one patient-identifying attribute retains the encryption by the first encryption key specific to the LDF;
• perform an additional layer of encryption on the data records;
• and
• a second component configured to:
• assign an LDF identifier (ID) to the encrypted data records by matching attributes in the encrypted data records;
• and
• link the encrypted data records ID by ID, whereby a longitudinal database is formed.

A longitudinally-linked electronic database assembled from individual patient healthcare transaction data records, the electronic database comprising:

• multi-sourced data records in which patient identifying attributes are encrypted to preserve patient privacy,
• wherein each encrypted data record is assigned an identifier based on a statistical match of a select set of data attributes with a reference set of values,
• wherein the data records are linked by the assigned identifiers
• wherein, when received, the patient-identifying attributes are doubly encrypted on an individual attribute basis with a first encryption key specific to a central facility (LDF) and a second encryption key specific to a data supplier so that original unencrypted patient identification information in the patient-identifying attributes remains secret with respect to other data suppliers and
• wherein the electronic database is coupled to a hardware security module comprising an encryption application programmed to partially decrypt the received attributes using a decryption key complementary to the second encryption key so that the attributes retain only the encryption by the first encryption key specific to the LDF.