in the majority of industrialized countries , patient 
 identification lies at the heart of many of the concerns relating to    electronic 
 processing of health information . in august 2004 , the french government decided 
 by law to start a national project for an electronic health record called the it is designed to promote 
 health care coordination , enhance communication of health information , and 
 reduce iatrogenic accidents . the information system corresponding to this 
 project is still under construction . regarding the patient identifier , one of 
 the proposals has been to use the existing social security number ( ssn ) . however , 
 civil society and bodies representing citizens ( patients ' associations , those 
 defending individual liberties , national councils of medical associations ) are 
 worried , quite rightly , about the security of medical information   should the ssn be used as an identifier in the field of health . they are afraid 
 that medical information may be linked with other information ( social , 
 economic , financial , employment ) often identified by the ssn . this is one of 
 the reasons why the government decided to postpone this project ( november 2007 ) 
 . nevertheless , in december 2007 , a working group was mandated by the government 
 to propose , as soon as possible , a solution for the hin , which will be used not 
 only for the dmp project but also for health in general . through this paper , we first propose 
 a method which aims both to reassure citizens ' representatives regarding the 
 security of medical information and to give the opportunity to the french government 
 to utilize a derived ssn with the same reliability as the ssn . a solution based 
 on the utilization of anonymity techniques secondly , 
 we analyse the conditions necessary to make this first solution interoperable 
 at the european level . in 
 an increasing number of countries , patients have direct access to their medical 
 records ( mr ) , and some countries including france 
   have decided to provide a personal medical record 
 ( pmr ) to the patient . we define mr 
 as patients ' medical information recorded by the medical practitioner under his 
 or her own responsibility and ideally electronically signed by him / her in order 
 to authenticate the provider ( health professional ) and to prevent any 
 modification of its content . in 
 contrast , the pmr is personally supervised by each patient , who has the right 
 to mask any information he / she does not want to be read . as the owner of this 
 pmr , the patient determines who can gain access to his / her record . of course , 
 patients are very worried that information concerning their private lives may 
 be disclosed . such concerns are increasing as more sensitive medical details , 
 such as psychiatric records , hiv status , and genetic information , are stored in 
 their pmrs . in france , 
 to enhance the coordination of care , the pmr 's data will be stored in national 
 shelters . so patients need to be sure that medical information may not be linked with other 
 information ( social , economic , financial , employment ) also identified by the 
 ssn , if the ssn was used as an identifier for the pmr . many 
 other countries have chosen a homogenous national patient identification system 
 ( e.g. , northern european countries such as denmark , finland , luxembourg , 
 the netherlands , belgium , the united kingdom , and ireland ) , and the former 
 countries in this list are even using the same identification number for other 
 fields than health care . apart from belgium , the above - mentioned 
 countries implemented a unique patient identifier some time ago , and the 
 citizens are used to it and to the creation of national health databases . however , in the united kingdom , patients are reassured because there is no 
 national shelterer and medical records are stored by the general practitioner 
 who can not transmit or receive any information regarding a patient without 
 his / her consent . in southern european countries identification is 
 often organized at a regional level ( spain and italy ) and patients are more 
 familiar with the creation of large health databases organized at a federal 
 level as in other countries ( canada and the usa ) . to reassure french patients regarding the 
 security of their medical data which will be stored at a national level , we 
 propose in this paper the creation of a secure patient identifier which should be different from 
 the ssn to avoid linkage with other data , but which should be as reliable as 
 the ssn . this proposed solution could 
 be used by any country needs to implement a unique health identification  
 number . as we said before , it is perfectly possible to preserve the 
 confidentiality expected by the patient by putting in place anonymity procedures [ 6 , 7 ] such as 
 those adopted by the institut de veille sanitaire ( the french 
 institute for public health surveillance )   on the recommendation of the french national 
 commission for data protection , in the context of followup procedures for the 
 30 diseases subject to mandatory reporting ( including aids ) . unlike encryption methods that must be reversible to allow 
 the legitimate recipient to decode the message , unidirectional hashing 
 techniques , such as the standard hash algorithm in its modified version sha-2 ( sha-2 is considered significantly 
 stronger  than sha-1 , although somewhat slower : nsa and nato recommend it in 
 the suite - b package ( ecc , aes and sha-2 . ) ) , 
 are irreversible . hashing produces a strictly anonymous    code ( it is not 
 possible to retrace the patient identity ) that is always the same for a given 
 individual and thus ensures that patient data can be linked . there are many 
 medical applications including the creation of national databases ( such as 
 those relating to the national followup of infected persons  approximately 100 000 patients  which are an excellent 
 example of how it can help epidemiological research , with complete patient 
 approval ) as well as regional and interregional databases in many areas 
 ( cancer , perinatal diseases , genetic diseases ) . this system , which is based on 
 the hash coding of the social security number , the gender and the date of birth , has also made 
 it possible to link all standardized hospital discharge abstracts , classified 
 into french diagnosis - related groups at the french national level , and to link 
 the data of the national medical insurance information system . an anonymity 
 procedure based on hash coding is also used to chain patient files in switzerland 
  . similar solutions , also derived 
 from the irreversible encryption of the unique social security number , have 
 been proposed in belgium   and new zealand . in the case of the pmr , the situation is no more complex 
 because similar requirements must be met . the french commission for data 
 protection , and associations of patients and healthcare professionals demand 
 the confidentiality of personal information contained in the pmr . public health bodies or individuals 
 need to have access to these data , particularly when the patient has given express 
 consent . the french commission for data 
 protection , and associations of patients and healthcare professionals demand 
 the confidentiality of personal information contained in the pmr . public health bodies or individuals 
 need to have access to these data , particularly when the patient has given express 
 consent . regarding confidentiality , insofar as 
 the social security number ( ssn ) could not be reconstituted using the health identifier number ( hin ) , the link between them would 
 be broken . another advantage of using hash coding 
 is that it meets the criterion of being focused ( created and maintained solely 
 as a support for health care ) . this is one of the main criteria of a universal 
 health care identifier that were published by the american society for testing 
 and materials , a standards development organization accredited by the american 
 national standards institute , in the standard guide for properties of a universal 
 healthcare identifier . this solution 
 satisfies the demands of french commission for data protection in that the ssn would be rendered anonymous by a 
 trustworthy third party and would thus permit the generation of a health identifier number ( hin ) known by the patient . this 
 supposes that the hin would be included in the patient smart card , used for 
 administrative and financial purposes ( reimbursement of medical care ) . for french patients associations , the interest and importance of 
 printing the health identifier number ( hin ) on the patient smart card lie in the fact 
 that it would mobilize and sensitize patients , 
 and increase their awareness that the identifier is different from the ssn . in 
 fact , if the ssn was rendered 
 anonymous using a hash algorithm , there would be no link between the new number 
 and the personal details of the individual , which is not the case for the ssn . nevertheless , it seems to us that this solution is an 
 illusion in terms of security and reliability because the correspondence 
 between the ssn and hin would be set out on the patient smart card and would 
 therefore also be known by the health workforce : the ssn is needed in the smart 
 card for reimbursement purposes . with regard to methodology , to provide anonymity safely 
 requires double hashing , because anonymity is not guaranteed by a single hashing 
 process [ 6 , 7 ] ; two hashing keys must be used to obtain complete anonymity . 
 as a consequence , this solution must be completed by the following principles . 
 according to figure 1 , the health professional can provide to the portal of the 
 application a coding hin obtained through reversible encryption . the hin will itself be transformed into a stocking hin in the same way 
 that the ssn was transformed into an hin , but with a different key ( see figure 1 ) . this portal can then transmit this code to the data - processing shelterer safely and reliably . if a person manages to get the ssn of a patient and uses the 
 hash function , he has to know the key used by the trustworthy third party to 
 obtain the hin of the patient . however , as the ssn and 
 the hin of the patient will both be included in the smart card of the patient 
 and used by health professionals , there is a risk of a breach of privacy in 
 health structures . the 
 aim of hash coding of the hin by the portal ( with a more different key than 
 that used for hash coding the ssn ) is to obtain an anonymised identifier ( stocking 
 hin ) before sending it to the data processing shelter . it also seems fundamental to us that prerequired conditions 
 be imposed in terms of security and confidentiality   regarding access to 
 medical data in health structures . this raises several concerns , the first of 
 which is related to the authentication of health - care professionals . the 
 solution would be a smart card attributed to professionals in both the private 
 sector and public hospitals . in france it is not only about 
 controlling the right of access to different applications , but also about 
 ensuring the security of local hard disk storage , preventing direct access to the 
 databases , and guaranteeing the security of external archives ( band and 
 cd - rom ) . lastly , we are also very concerned about the security of exchanges 
 among health professionals . we must point out that many health - care 
 professionals require access to medical records from home , for example , or when 
 on call . a similar situation arises when records are forwarded to doctors 
 during vacations through the internet . we also know that some data processing 
 specialists or computer science experts need access to health structure data 
 for application maintenance . we then strongly recommend the use of networks 
 like virtual private network , in addition to the professional authentication 
 card , as a solution to the problem of the security of data exchange . mobility must 
 not compromise healthcare for european nationals . residents of one member state 
 travelling to or working in another member state should have the same right to 
 high - quality healthcare as all other europeans ( see , e.g. , regulation 
 ( ec ) no 883/2004 ) . it is thus very important to ensure interoperability between 
 the patients identifiers in the different european countries . however , in europe , each country has its own patient identifier with 
 very different structures and contents , and which may not always be derived 
 from an ssn . as a consequence , the use of the ssn alone ( or a derived ssn ) to generate the hin in 
 european countries would not solve the interoperability   problem . one solution would be to add personal patient characteristics 
 such as family name , first name , date of birth ( separately hashed ) to be able 
 to link data even in the case of field errors or other local errors to the ssn , 
 which would help to comply with the recommendations of the international association 
 of medical information technology , and where possible to ensure 
 interoperability of this identifier with a european identifier . we 
 propose to add to the european health card , as well as the national social 
 insurance number of the patients in each country , a family - based identifier 
 which could contribute to the harmonisation of patients ' identification at the 
 european level . this solution would lead to the creation of a european health 
 identifier which would allow patient data to be gathered anywhere in europe , whatever their location , even if their social 
 insurance number changes according to their country of residence . this will be 
 useful , at the individual level , to provide higher quality health care due to a 
 better followup of the patient and to facilitate the reimbursement of health 
 care costs . at the community level the great advantage of this european health 
 identifier based on the family component is that it is built from very basic 
 information , which is available to everybody , easily checkable and permanent 
 throughout the patient life . our proposal to use the family - based identifier to create a unique 
 european identifier will make it possible to link the data of a patient even 
 when he or she resides outside his or her home country in europe . it will also contribute to the establishment of european public health 
 statistics by matching healthcare data of the patients records with other 
 administrative data ( mortality , social information , etc . ) after anonymisation 
 of these data in accordance with the european directive on data protection . we 
 could also propose to use biometric technologies ( and then apply hash coding to 
 ensure anonymity ) . biometric technologies are sometimes proposed as a way to 
 associate a patient with his or her medical data , as they do not require the 
 patient to bring any documents or remember any information . though this 
 technology represents real progress both in the identification and in the 
 authentication of the patient , there are still many questions   regarding the accuracy and reliability of each biometric 
 technology and the associated costs . but the main problem lies in the acceptability 
 of such systems by organisations concerned with ethical considerations such as 
 patients ' associations , national ethics committees , human rights associations , 
 and national committees for data protection . for example , in france , the use 
 of biometric solutions for identification in the field of health has not been 
 approved by the national ethics committee . initially , 
 the government planned to use the ssn as an hin , as health professionals 
 already know the ssn for health reimbursement reasons . patients ' associations , 
 those defending individual liberties , national councils of medical 
 associations , have asked for an identity number hin that is different from the 
 ssn , their requirements are the following . 
 first , that patients are made 
 aware that the hin used for medical care is not the same as the ssn.second , that there are two 
 different databases for health professionals ( located in hospitals or in other 
 structures ) : a database for health reimbursements which will exclusively use 
 the ssn for administrative reasons , and another medical care database for 
 medical purposes which will not use the ssn because of its private aspect , but 
 an anonymous identity number hin different from the ssn . we had to comply with these requirements and are thus obliged 
 to provide tables to show the link between the ssn and the hin 
 for all patients in all health structures for administrative purposes , which 
 can be considered as the most important disadvantage of the proposed solution . first , that patients are made 
 aware that the hin used for medical care is not the same as the ssn . second , that there are two 
 different databases for health professionals ( located in hospitals or in other 
 structures ) : a database for health reimbursements which will exclusively use 
 the ssn for administrative reasons , and another medical care database for 
 medical purposes which will not use the ssn because of its private aspect , but 
 an anonymous identity number hin different from the ssn . patients ' 
 associations and national councils of medical associations have been aware of 
 the need for a correspondence table between administrative databases ( for 
 health reimbursements ) and personal databases ( for medical purposes ) . this 
 correspondence table was not a real problem for them as such tables currently 
 exist in hospitals because of the need to link medical personal data ( hospital 
 discharge abstracts referenced by the first and second name , date of birth , 
 etc . ) with billing data referenced by the ssn . this particularly arises from 
 the fact that administrators need to have access to medical information in 
 order to determine the levels of hospital activity and justify hospital 
 budgets . the solution for the existing correspondence table between 
 administrative databases ( for health reimbursements ) and personal databases 
 ( for medical purposes ) was to put it under the responsibility of the medical 
 information department . that is why the associations concerned consider that 
 using an hin obtained through irreversible transformation of the ssn provides 
 more security than the current situation where the medical data are stored with 
 personal characteristics ( first and second name , date of birth , etc . ) . we consider 
 that our proposal must be accompanied by the reinforcement of measures 
 regarding the security of medical information inside hospitals , as proposed at 
 the end of the section 3 . in particular , we 
 focused on the need to code ( reversible encryption ) both the hin and ssn in 
 hospitals when they are related to health - care databases . as a consequence , the main concern 
 regarding the personal medical record ( pmr ) and centralised storage of patient 
 medical information is 
 the security of data , not only at the level of the health structures , but also 
 at the data - processing shelterer . knowing that a correspondence table between 
 the ssn and the first hin would exist in health structures , we propose 
 transforming the first hin into a storing hin by using an irreversible 
 encryption method to secure storage ( data - processing shelterer ) . as only the 
 manager of the portal will know the key of this second hashing , no dictionary 
 attacks can be used to try to obtain the first hin , and thus the corresponding 
 ssn through the   correspondence table ( if hashed at the health structure level ) . first , in terms of organisation , it avoids 
 implementation of the hashing function at the level of the health professional . second , it also avoids supplementary costs , implementation delays , and the 
 disclosure of the technical 
 hashing system to other actors . the second 
 advantage is that it provides the possibility to use different hash - coding keys to generate a 
 different hin for each major application such as the pmr , regional , and/or 
 national applications such as health care networks , health administration , diagnosis and healthcare , and epidemiological research 
 without delivering the corresponding application keys to all of the health 
 professionals . moreover , hashing responsibility and key management can be 
 delegated to each application . if the 
 concept of specific hins for different applications is accepted , it will be 
 necessary to create a structure similar to the data matching agency created in australia to manage all of the identifiers . this agency could be in charge of matching with regard to legal , deontological , organisational , and technical aspects , since the trustworthiness of such an agency is based on a complex combination of legal obligations ( in order to provide justifiable legal reliability ) and organisational - and - technical security measures ( in order to provide justifiable robustness with regard to accuracy of data ) . management of 
 hins consists in not only ensuring the linkage of the different databases , but 
 also guaranteeing the security of the different identifiers . for example , the 
 real risks raised by using the same identifier in regional and national 
 applications have to be considered : it is important to preclude the possibility 
 of unauthorized linkage by indirect means . this agency could also manage the 
 distribution of encryption keys among the different applications and actors . to 
 ensure that legislation is respected and the interests of the patients 
 protected , the agency would liaise with national commissions for data protection . our proposal for a french health identification number would 
 make it possible to uniquely identify and link a patient to his or her specific 
 medical data . hashing the social security number will allow linkage between the 
 information of the personal medical file and other national sources of health 
 information with the aim of completing or validating the personal medical 
 record or performing epidemiological research . adding personal patient 
 characteristics such as first name and family name , date of birth and/or 
 biometric identifiers ( separately hashed , then merged ) to the hashed social 
 security number could also be proposed in the discussions about the creation of 
 a european health care identifier . it would thus contribute to the establishment of european public health statistics by matching healthcare data of the patients records with other administrative data . these data linkage systems would meet the requirements for anonymous data issued in the european directive on data protection .
we propose a method utilizing a derived social security number with the same reliability as the social security number . 
 we show the anonymity techniques classically based on unidirectional hash functions ( such as the secure hash algorithm ( sha-2 ) function that can guarantee the security , quality , and reliability of information if these techniques are applied to the social security number ) . 
 hashing produces a strictly anonymous code that is always the same for a given individual , and thus enables patient data to be linked . 
 different solutions are developed and proposed in this article . 
 hashing the social security number will make it possible to link the information in the personal medical file to other national health information sources with the aim of completing or validating the personal medical record or conducting epidemiological and clinical research . 
 this data linkage would meet the anonymous data requirements of the european directive on data protection .