Record Linkage Under Pseudonymisation
Deciding which pseudonymised records belong to the same person once the real identifier is gone — a probabilistic join whose two failure modes, merging two people and splitting one, trade off against each other and are set by how the pseudonym was built.
What it is
Pseudonymisation replaces a direct identifier with a derived one. The point is that nobody downstream can recover the person; the consequence, usually left unstated, is that the join key is no longer exact. Anything requiring “all records for this patient” — a pathology history, a follow-up interval, a recurrence — now rests on a decision rather than a lookup.
Two failure modes sit at opposite ends of one dial, and which one you get is decided when the pseudonym is designed:
- Collision (false merge). A pseudonym built from few, coarse attributes will be shared by different people. Their records fuse into one apparent patient with an impossible history.
- Splitting (false separation). A pseudonym built from more, finer attributes is sensitive to how those attributes were recorded. One person whose name is entered differently on two occasions becomes two patients, each with half a history.
Making the key more distinctive trades collisions for splits. There is no setting that removes both, which is why the interesting systems report the ambiguity instead of hiding it.
The worked example
Siebers 2026 — The Dutch Nationwide Pathology Databank (Palga) describes the Dutch national pathology databank doing exactly this, and is unusually explicit about it.
Palga’s scientific database carries two pseudonyms per person, built to sit on opposite sides of the trade-off:
| Construction | Behaviour |
|---|---|
| date of birth + sex + first four letters of surname at birth | less distinctive → collides |
| date of birth + sex + first initial + first eight letters of surname at birth | more distinctive → splits |
Neither is treated as authoritative. Data stewards assemble a patient’s records by probabilistic linkage across pseudonymised characteristics: records join when similarity across key attributes is sufficient, and a mismatch on a weakly discriminative field — initials differing because one record used a first name and another a formal name — does not on its own block a match.
The part worth copying is what ships with the data. Every excerpt carries a quality indicator, administrative_duplicate_probability, on a three-level ordinal scale from “non” to “present – likely”, computed for both the target records and the historical ones, and reflecting internal consistency where a patient has several. The researcher therefore receives a per-record statement of how confident the provider is that this join is right.
Note also what the researcher does not receive: not the pseudonyms, only randomly assigned study-specific identification numbers. The linkage is performed by the party that can see the pseudonyms, and its uncertainty is passed downstream as a variable rather than as an assumption.
2026-08-23 — Version of Record filed. The note was written from the journal pre-proof; the VoR (J Pathol Inform. 2026 Aug;22:100695, PMID 42592080) now sits beside it as siebers-2026-palga-databank-vor.pdf. Everything above survives unchanged — every headline number and the whole linkage passage are identical in the VoR. Three of the note’s pre-proof caveats are settled: Table 1 is now readable (pseudonymisation, coded diagnostic reporting, PF-CM and use of the scientific database are updated since Casparie 2007; SSR, SNOMED CT, governance, the legal/ethical framework, the public database, registry linkage — and the blocking PODS-CM validator itself — are new, so the enforcement mechanism the note calls “the part that matters” is a post-2007 addition); the competing-interests template is filled in (none declared, so that [unverified] was indeed a pre-proof artefact); and the four data-flow figures are embedded and match the note’s architecture description (Fig. 2 labels the Hub “Index”; Fig. 3 places the first pseudonymisation inside the hospital intranet, the second at the ZorgTTP module). The calibration gap under Open questions is unchanged by the VoR.
Why it matters for my work
Not because Palga’s data is reachable — it is not, since access requires a collaborating Dutch pathologist — but because this group builds pseudonymised datasets and joins them, and has never written down what that join costs.
Three concrete places it bites.
Slide-level versus patient-level grouping. Splitting a train/test set at the slide level when two slides belong to one patient is leakage, and it is the failure this wiki already warns about in External Validation. Splitting correctly requires knowing which slides share a patient — which, after pseudonymisation, is precisely a linkage decision. A false split silently puts one patient on both sides of the partition. A leakage check is only as good as the linkage underneath it, and nothing here records the linkage quality for any cohort.
Denominators. Coverage Bias is about the records carrying a field not being a random sample. Linkage error is the same problem one level down: if merges and splits are more likely in some group — longer or non-Turkish surnames, transliteration variants, name changes after marriage — then a per-patient rate is measured with a group-dependent denominator. The two pseudonym constructions above make this concrete, because both are surname-prefix schemes and surname length is not randomly distributed.
Counting patients at all. Any statement of the form “N patients” in a pseudonymised cohort is an estimate. Recorded as an exact figure, it hides the fact that it was produced by a threshold somebody chose.
The transferable design rule: when you pseudonymise, decide which failure mode you prefer, say so, and carry a linkage-confidence flag alongside the data. Two records that might be one person are a fact about the data, not a defect to be resolved silently by whoever runs the join.
How it connects
De-identification — the upstream step this is the downstream cost of; pseudonymising well and linking well pull in opposite directions, and that tension belongs on both pages.
Siebers 2026 — The Dutch Nationwide Pathology Databank (Palga) — the national infrastructure that publishes its own linkage uncertainty as a shipped variable, and the only worked example here.
Coverage Bias — the same shape of problem: a metric that partly measures how the data was assembled rather than what it is about. Linkage error is a denominator problem wearing a different name.
External Validation — patient-level splitting is impossible to guarantee without a trustworthy patient key, so linkage quality bounds how strong a leakage claim can be.
Report Text Extraction — free-text reports are where residual identifiers and name variants survive, and name variants are exactly what makes surname-derived pseudonyms split.
Memorial LIS Extracts — the structured backbone here, and the place any of this would be measured; it already carries documented field-reliability caveats, which is the same category of problem.
Open questions
- How are patients identified across this group’s own cohorts? Whether records are joined on a hashed accession number, a hospital identifier, or a derived pseudonym is not recorded on any page here, and each has a different failure mode. This is the first thing to establish.
[unverified] - Turkish naming makes the Palga scheme worse, not better. A surname-prefix pseudonym assumes stable ASCII spelling; Turkish orthography (
ı/i,ş/s,ğ/g,ö/o,ü/u,ç/c) means a name transliterated differently across two systems yields two pseudonyms. Any scheme copied from this paper needs a normalisation step first, and that step is where the collision rate goes back up. Nobody has measured it here. - Palga publishes no calibration for its indicator. Three ordinal levels arrive with each record and the paper gives no sensitivity, specificity, or the similarity rule behind them — so a researcher can stratify by it but cannot turn it into a bias estimate. Copying the pattern without publishing a calibration would inherit that limitation.
[unverified] - Is there a defensible way to report “N patients” with an interval rather than a point estimate when the linkage is probabilistic? Not addressed in the source, and it is the honest form of the number.