FAQ

Each answer summarizes the specification and links to the governing text. The specification governs.

What does the specification require?

If a query's identity attributes correspond to a combination in Table 2, and the query produces a unique candidate, the responding entity SHALL return matching records for that patient within the permitted scope, subject to the administrative controls in section IV.D and Table 4. See For Decision Makers.

What is P(collision)?

The probability that two distinct individuals in the population share identical values for a given combination of fields. It measures the discriminating power of the combination itself, independent of any algorithm or vendor. See Summary and Purpose and How the Numbers Are Derived.

Why 2e-12?

Core Principle 1 says thresholds SHALL NOT be arbitrary and states the threshold as 2e-12, or 1 in 500 billion. Section IV.D says the threshold was chosen from the clustering of combinations commonly used in national matching products, compared against a distribution of field combinations and their supersets. See Joint Collision Probability.

Is meeting the threshold enough for a combination to be approved?

No. The specification calls passing the threshold a necessary condition, not a sufficient one. Administrative risks such as data independence, shared contact channels, reassignment, multiple births, and generational names are evaluated too. See Joint Collision Probability and Administrative Restrictions.

Do we have to collect SSN or ITIN?

No. An organization's decision not to collect them does not constitute non-compliance. Full SSN and full ITIN SHALL NOT be transmitted in matching queries; only the last four digits are used, as optional attributes. See SSN and ITIN. The IAL2 token field table lists a full-SSN claim as optional, which the specification does not reconcile with this (see Status).

Is fuzzy matching allowed?

Yes, within limits. It applies only where Table 2 marks a field, it is not applied to strings shorter than 5 characters, and Soundex and other phonetic matching are prohibited, except that phonetic comparison on first and last name is permitted where the implementer can validate the technique against the approved test datasets at or below the framework's false-positive threshold. See Fuzzy Matching.

What if more than one record matches?

A match requires a unique candidate. The specification describes escalation when two candidates are found and a stricter threshold, with a possible decline, when three or more are found. See the Implementation Guide.

Do we have to implement Table 2 exactly?

The Executive Summary says failing to return records when a query satisfies a Table 2-listed combination and produces a unique candidate is non-compliant. It also names two compliance paths: Path A (Assumed Compliance, rules-based) and Path B (Empirical Compliance, performance-based), which Audit and Monitoring describes. Section IX proposes that the framework be a baseline against which existing methods can be tested, not a mandated replacement for methods that already meet or exceed its performance, with a phased adoption period and safe harbor. Those are proposals and are not yet in effect. See Implementation and Testing.

How do we check our implementation?

An implementation SHALL demonstrate documented performance on the ONC patient matching test dataset, on a successor dataset, or through an approved third-party assessment, reporting at least precision, recall, and false-positive rate at the configured operating point. The public test set is built from the ONC dataset. See Validation Requirements.

Is the reference implementation required?

No. The reference implementations are provided to help. If one differs from the specification text, the specification governs.

Does the specification say what data to return, or how?

No. It defines when a responding entity returns matching records, and does not set governance or protocol recommendations beyond matching, such as the data returned, exchange purposes, or enforcement. See Summary and Purpose.

FAQ