Question

Two hospitals want to identify patients who received treatment at both facilities to coordinate care, but neither is permitted to disclose plaintext patient identifiers (name, date of birth, national health ID) to the other. A privacy engineer must design a technique that lets both parties match overlapping records without either side learning the identifiers of non-matching patients. Which approach BEST meets this requirement?

Accepted Answer

Implement privacy-preserving record linkage using cryptographically hashed (e.g., Bloom filter–encoded) identifiers exchanged under an agreed keyed scheme

Answer

Have each hospital pseudonymize identifiers with its own internal tokenization vault and exchange the resulting tokens

Answer

Exchange the identifiers over a mutually authenticated TLS channel and delete them after matching

Answer

Aggregate each hospital's patient counts and apply differential privacy noise before comparison