IDENTITY & TRUST CONNECTORS

Patient Identity & MPI

2 of 6

Verify and link patients, professionals, organizations and trust frameworks while keeping authentication, identity proofing and authorization separate.

MPIPatientNational IDsPIX / PDQMatchingDuplicatesProvenance

Single Patient View

Link identities across systems to one accurate patient record.

Interoperable

Support national identifiers and cross-system identity exchange.

Safe & Controlled

Use confidence scoring and human review for ambiguous matches.

Auditable

Track links, merges, unlinks and decisions with provenance.

Identity Sources

National Identifiers

CNS, NIR/INS and other trusted identifiers where legally appropriate.

HIS / EHR / HIE

MRN and source-system identifiers.

Verified eID

Identity assertions from trusted providers when available.

Demographics

Name, birth date, contact and address attributes used under matching policy.

Matching & Reconciliation

Normalize

Normalize identifiers and demographics without losing source values

Match

Deterministic + probabilistic matching

Score

Confidence and conflict signals

Decide

Auto-link only above approved threshold; otherwise review

Reconcile

Maintain links and source-of-truth history

Duplicate Management

Detect duplicate patient candidates before creating new records

Require controlled review for ambiguous merges

Preserve all source identifiers and identity history

Support reversible link/unlink operations where possible

Never silently overwrite identity evidence

Propagate corrected identity references through governed workflows

APIs & Examples

httpCopy

# Illustrative Mediloop identity contract
POST /v1/identity/patients/resolve
Authorization: Bearer <token>
Content-Type: application/json

{
  "identifiers": [{"system":"urn:source:mrn","value":"A-10442"}],
  "demographics": {"birthDate":"1980-04-17","family":"Martin"},
  "autoLink": false
}

Illustrative route. MPI matching thresholds, national identifiers and production contracts must be governed and versioned before release.

Data Model

Entity	Purpose	Key attributes
Mediloop Patient	Stable internal patient identity	id, status, tenant context
External Identity	Identifier from source system	system, value, issuer, validity
Identity Link	Relationship to patient	source, confidence, status, timestamps
Match Evidence	Why a decision was made	rules, score, matched attributes
Merge / Unlink Event	Identity lifecycle history	actor, reason, before/after, audit

Security & Compliance

Restrict access to strong patient identifiers

Encrypt identifiers and minimize exposure

Use purpose-bound access to MPI operations

Human review for risky merge/link decisions

Full audit trail and provenance for identity operations

Retention and correction policies aligned with national rules

Error Handling

Condition	Expected handling
No match	Return no-match; create only under explicit workflow
Possible match	Return candidates for controlled review
Conflicting strong identifiers	Block automatic link and escalate
Source unavailable	Do not guess; preserve pending reconciliation state
Duplicate request	Use idempotency / correlation ID

Best Practices

Prefer strong authoritative identifiers when lawful and available

Treat demographic matching as evidence, not certainty

Keep source identities linked rather than collapsed

Version matching rules and thresholds

Measure false-match/duplicate metrics

Reconcile corrections across downstream clinical records

Developer Integration Surface

Surface	Operation / resource	Use	Status
Patient FHIR	Patient / identifier	Clinical patient representation	FHIR
IHE identity	PIX / PDQ where applicable	Cross-system identity query/link	IHE
MPI API	resolve / link / unlink / review	Mediloop patient identity workflow	Planned/versioned
Events	patient.identity.linked / merge.review_required	Downstream synchronization	Planned/evolving

Next Steps

Inventory source identifiers

Define matching policy and thresholds

Configure review workflow

Test duplicates/conflicts/corrections

Monitor match quality in production