Master Patient Index (MPI)

At its core, an MPI assigns a permanent, unique Enterprise Identifier (EUID) to every patient. This identifier is distinct from local Medical Record Numbers (MRNs) assigned by individual source systems. The EUID acts as a global pointer, linking all local records for a single patient without replacing the native identifiers. This architecture ensures that a patient's cardiology record in one system and their lab results in another are logically unified under a single, non-duplicated identity.

Modern MPIs rely on probabilistic matching algorithms rather than simple exact-match logic. These engines use statistical models to calculate the likelihood that two records belong to the same patient, even with data inconsistencies.

• Weighted field comparison: Fields like Social Security Number carry more weight than gender.
• Fuzzy logic: Tolerates typographical errors (e.g., 'Jon' vs 'John') and phonetic variations (Soundex/Metaphone).
• Threshold tuning: A match score above a configurable threshold triggers an auto-link; scores in a grey zone flag records for manual review.

An MPI must manage conflicting demographic data from multiple source systems through survivorship rules. This logic determines which system's data is considered the most current and authoritative when a conflict is detected.

• Source priority: A registration system may be ranked higher than a lab system.
• Temporal reasoning: The most recent timestamped update often wins.
• Field-level granularity: The best address might come from a billing system, while the best phone number comes from a patient portal. The MPI composites a 'golden record' from the best attributes across all sources.

No matching algorithm is perfect, necessitating robust manual stewardship tools. An MPI must provide a user interface for data stewards to manually merge records that were incorrectly left separate (false negatives) and, critically, unmerge records that were incorrectly linked (false positives). An unmerge operation must be a complete, audited transaction that restores the original distinct identities without data loss, as a false merge can create a dangerous commingled clinical record.

The MPI maintains a persistent, immutable cross-reference table that maps every local MRN from every source system to the single EUID. Every link, unlink, merge, and demographic update is recorded in a comprehensive audit trail. This log captures the timestamp, user, and justification for every identity action, providing full data provenance and supporting compliance with regulatory requirements for data integrity and patient safety investigations.

An MPI is not a static database but an active hub. When a patient's identity is updated, merged, or flagged as a potential duplicate, the MPI must broadcast real-time notifications to subscribing downstream systems via HL7 v2 ADT^A31 or FHIR messaging. This ensures that a correction made in the MPI is rapidly synchronized back to the source EHRs, registration systems, and billing platforms, maintaining identity integrity across the entire transactional ecosystem.