Privacy Preserving Probabilistic Record Linkage (P3RL): a novel method for linking existing health-related data and maintaining participant confidentiality.

Schmidlin, Kurt; Clough-Gorr, Kerri M; Spoerri, Adrian (2015). Privacy Preserving Probabilistic Record Linkage (P3RL): a novel method for linking existing health-related data and maintaining participant confidentiality. BMC Medical research methodology, 15(1), p. 46. BioMed Central 10.1186/s12874-015-0038-6

Schmidlin BMCMedResMethodol 2015.pdf - Published Version
Available under License Creative Commons: Attribution (CC-BY).

Download (1MB) | Preview


Record linkage of existing individual health care data is an efficient way to answer important epidemiological research questions. Reuse of individual health-related data faces several problems: Either a unique personal identifier, like social security number, is not available or non-unique person identifiable information, like names, are privacy protected and cannot be accessed. A solution to protect privacy in probabilistic record linkages is to encrypt these sensitive information. Unfortunately, encrypted hash codes of two names differ completely if the plain names differ only by a single character. Therefore, standard encryption methods cannot be applied. To overcome these challenges, we developed the Privacy Preserving Probabilistic Record Linkage (P3RL) method.


In this Privacy Preserving Probabilistic Record Linkage method we apply a three-party protocol, with two sites collecting individual data and an independent trusted linkage center as the third partner. Our method consists of three main steps: pre-processing, encryption and probabilistic record linkage. Data pre-processing and encryption are done at the sites by local personnel. To guarantee similar quality and format of variables and identical encryption procedure at each site, the linkage center generates semi-automated pre-processing and encryption templates. To retrieve information (i.e. data structure) for the creation of templates without ever accessing plain person identifiable information, we introduced a novel method of data masking. Sensitive string variables are encrypted using Bloom filters, which enables calculation of similarity coefficients. For date variables, we developed special encryption procedures to handle the most common date errors. The linkage center performs probabilistic record linkage with encrypted person identifiable information and plain non-sensitive variables.


In this paper we describe step by step how to link existing health-related data using encryption methods to preserve privacy of persons in the study.


Privacy Preserving Probabilistic Record linkage expands record linkage facilities in settings where a unique identifier is unavailable and/or regulations restrict access to the non-unique person identifiable information needed to link existing health-related data sets. Automated pre-processing and encryption fully protect sensitive information ensuring participant confidentiality. This method is suitable not just for epidemiological research but also for any setting with similar challenges.

Item Type:

Journal Article (Original Article)


04 Faculty of Medicine > Pre-clinic Human Medicine > Institute of Social and Preventive Medicine (ISPM)

UniBE Contributor:

Schmidlin, Kurt, Clough, Kerri, Spörri, Adrian


600 Technology > 610 Medicine & health
300 Social sciences, sociology & anthropology > 360 Social problems & social services




BioMed Central




Doris Kopp Heim

Date Deposited:

12 Jun 2015 14:26

Last Modified:

05 Dec 2022 14:47

Publisher DOI:


PubMed ID:





Actions (login required)

Edit item Edit item
Provide Feedback