T3.1: Explains Safety Implications for Mismatched Records

InterSystems EMPI (Enterprise Master Patient Index), formerly known as HealthShare Patient Index (HSPI), serves as the critical infrastructure that links patient records across multiple healthcare facilities and systems. When EMPI linkage errors occur, the consequences extend far beyond data quality issues—they create genuine patient safety hazards that can result in serious harm or death.

The fundamental purpose of EMPI is to ensure that all records belonging to the same individual are correctly linked together under a single Master Patient Index ID (MPIID). When this linking process fails or produces incorrect results, clinical systems that rely on EMPI data will display incomplete, inaccurate, or dangerously misleading patient information to healthcare providers.

Understanding the patient safety implications of EMPI errors is critical for anyone working with InterSystems EMPI. This knowledge helps EMPI administrators, identity management specialists, and healthcare IT professionals prioritize their worklist activities and allocate expert staff to the most dangerous categories of linkage conflicts.

The Critical Nature of EMPI in Healthcare

EMPI systems sit at the foundation of healthcare information exchange. Clinical applications such as HealthShare Clinical Viewer, electronic health records (EHRs), and health information exchanges (HIEs) query the EMPI to determine which patient records should be displayed when a clinician searches for a patient. If the EMPI contains incorrect linkage information, these clinical systems will retrieve and display the wrong data, leading clinicians to make decisions based on false information.

Consider a typical clinical workflow: A physician searches for patient "John Smith" in the Clinical Viewer. The EMPI returns all records linked under John Smith's MPIID. If the EMPI has incorrectly linked records from two different John Smiths, the physician will see a merged view of both patients' data—medications, allergies, lab results, diagnoses, and procedures—all displayed as if they belong to one person. The physician has no way of knowing that this composite view contains data from multiple individuals.

---

The impact of EMPI errors on patients manifests in several dangerous scenarios, each with the potential for serious harm.

Wrong Medication Administration

When patient records are incorrectly linked (an overlay or overlap situation), a patient's medication list may include drugs prescribed to a completely different person. A clinician reviewing this merged medication list might:

• Continue a medication that the actual patient has never taken
• Prescribe a new medication that interacts dangerously with drugs the real patient is taking (but which aren't visible because they belong to a different person's record)
• Fail to prescribe a necessary medication because they believe (based on the incorrect merged record) that the patient is already taking it
• Administer a medication to which the patient is allergic, because the allergy is documented in a different, unlinked record

Incorrect Diagnosis and Treatment Decisions

EMPI errors can cause clinicians to make treatment decisions based on false medical histories. For example:

• A physician sees lab results showing elevated blood sugar (actually from a different patient) and diagnoses diabetes in a patient who doesn't have it
• A surgeon reviews imaging studies (belonging to another patient) and schedules an unnecessary procedure
• An emergency department physician sees a history of drug-seeking behavior (from another patient's record) and dismisses legitimate pain complaints
• A cardiologist prescribes blood thinners based on a cardiac condition documented in another patient's record, causing bleeding complications

Missed Critical Information

Conversely, when records that should be linked are incorrectly separated (not linked when they should be), clinicians lack access to critical patient information:

• A patient's allergy to penicillin is documented at Hospital A, but when the patient visits Hospital B, the records aren't linked, and the allergy isn't visible
• A patient's previous surgical history is unavailable, leading to repeated imaging studies or redundant procedures
• A patient's current medications prescribed at one facility aren't visible at another facility, causing dangerous drug interactions

Privacy Breaches

In overlay scenarios (the most dangerous category), all data for both patients displays under one patient's name. This means Patient A can literally see Patient B's complete medical record—diagnoses, medications, procedures, HIV status, mental health history, substance abuse treatment, and other highly confidential information. This violates HIPAA regulations and causes significant distress to patients whose privacy has been breached.

The Most Dangerous Scenario: Medical Record Number Re-Use

According to sample question Q15 from the InterSystems EMPI certification exam, the most likely scenario in which a patient would see another patient's data is medical record number re-use at a facility. This occurs when a healthcare facility assigns the same MRN to two different patients, either due to:

• Clerical errors during patient registration
• System limitations in older registration systems
• Inadequate processes for checking for existing patients before assigning new MRNs
• Intentional re-use of MRNs from deceased or inactive patients

When MRN re-use occurs, EMPI systems may incorrectly link the two patients' records because they share the same facility and MRN—one of the strongest indicators of identity. This creates an overlay situation where both patients' complete medical records merge under a single identity.

---

EMPI errors place clinicians in an impossible position: they must make life-or-death decisions based on information they believe to be accurate, but which may be fundamentally flawed.

Compromised Clinical Decision-Making

Clinicians rely on the completeness and accuracy of patient records. When EMPI linkage errors occur, clinicians face several challenges:

Conflicting Information: When viewing a merged record containing data from multiple patients, clinicians may see contradictory information. For example, the record might show both "No Known Allergies" (from Patient A) and "Severe Penicillin Allergy" (from Patient B). The clinician must then waste valuable time trying to determine which information is correct, potentially delaying urgent treatment.

False Confidence in Incomplete Data: Even more dangerous is the situation where a clinician reviews what appears to be a complete patient record but is actually missing critical information because records that should be linked are separated. The clinician proceeds with confidence in their decision, unaware that they're working with incomplete data.

Cascade of Errors: Once an initial treatment decision is made based on incorrect EMPI data, subsequent decisions build on that foundation, creating a cascade of errors that compounds the patient safety risk.

Erosion of Trust in Clinical Systems

When clinicians discover EMPI errors, their trust in the entire EHR system diminishes. This leads to:

• Increased time spent verifying information with patients directly
• Reluctance to rely on data from outside facilities
• Workarounds that bypass the EMPI-linked data, reducing the value of health information exchange
• Cynicism about interoperability initiatives

Medical-Legal Liability

Clinicians bear professional and legal responsibility for their treatment decisions, even when those decisions were based on inaccurate EMPI data. While a clinician might argue that they relied on system-provided information, medical negligence cases often hinge on whether a "reasonable physician" would have recognized the discrepancy or taken additional steps to verify the information.

Workflow Disruption and Burnout

Investigating EMPI-related discrepancies takes time away from patient care. When clinicians encounter frequent data quality issues, it contributes to documentation burden and system-related frustration, both major contributors to physician burnout.

---

Healthcare organizations bear ultimate responsibility for the accuracy and reliability of their EMPI systems. The consequences of EMPI errors extend across multiple organizational domains.

Legal and Financial Liability

When EMPI errors lead to patient harm, healthcare organizations face:

• Medical malpractice lawsuits with potentially significant settlements
• Regulatory fines for HIPAA violations when patients see each other's data
• Joint Commission sanctions if EMPI errors are found to compromise patient safety
• Increased malpractice insurance premiums
• Costs associated with adverse event investigation and root cause analysis

Regulatory Compliance Risks

Healthcare organizations must maintain accurate patient identification systems to comply with numerous regulations:

• HIPAA Privacy Rule: Requires safeguards to protect patient information from inappropriate disclosure. Overlay errors that expose one patient's data to another constitute a privacy breach requiring notification and potential penalties.
• Joint Commission National Patient Safety Goals: Include requirements for accurate patient identification. EMPI errors directly undermine these safety goals.
• CMS Conditions of Participation: Require accurate patient records. Systematic EMPI errors could jeopardize Medicare/Medicaid participation.

Operational and Financial Costs

Beyond liability, EMPI errors create ongoing operational costs:

• Redundant Testing: When patient records aren't linked, previous test results aren't available, leading to repeated imaging studies, lab work, and diagnostic procedures that waste resources and expose patients to unnecessary radiation or risks.
• Extended Hospital Stays: Delays in accessing complete patient information can extend hospital stays while clinicians gather missing data.
• Administrative Burden: Staff time spent investigating discrepancies, correcting errors, and manually linking or unlinking records.
• IT Resources: Database cleanup, MPIID reassignment, and composite record regeneration all require technical staff time and system resources.

Reputational Damage

In an era of public quality reporting and online reviews, EMPI-related errors can damage an organization's reputation:

• Patients who discover they viewed another patient's data lose trust in the organization
• Referring physicians lose confidence in the quality of shared patient information
• Health information exchange partners may question the reliability of data from an organization with known EMPI issues
• Media coverage of serious EMPI-related adverse events causes lasting reputational harm

---

The HealthShare Unified Care Record (UCR) Clinical Viewer and similar clinical applications rely on EMPI to determine which patient records to display. Understanding how different linkage conflict categories manifest in these clinical displays is crucial for EMPI administrators, as it directly relates to patient safety.

How Clinical Systems Query EMPI

When a clinician searches for a patient in the UCR Clinical Viewer, the system: 1. Sends the search criteria (name, date of birth, etc.) to the EMPI 2. Receives back the MPIID(s) associated with matching patient records 3. Queries data sources for all records linked to that MPIID 4. Aggregates and displays the combined data to the clinician

The critical point: The clinical system displays all data linked to a given MPIID, assuming that all records sharing an MPIID belong to the same individual.

Overlay Display (Most Dangerous)

An overlay occurs when two records that should NOT be linked (they represent different people) are incorrectly assigned the same MPIID, or when records are manually unlinked but one record is not assigned a new MPIID.

Display Implication: According to the EMPI certification exam sample questions (Q8, Q9, Q10), when viewing an overlay record pair in a clinical system such as the HealthShare Clinical Viewer, the system will display:

Answer: All the data for both patients in the pair, under one patient's name

This is the most dangerous scenario because:

• The clinician sees a merged view combining two different individuals' medical records
• There is typically no visual indication that the data comes from multiple people
• The volume of data may seem unusual, but clinicians often assume the patient simply has a complex medical history
• Contradictory information (different genders, birth dates, addresses) may appear in different sections of the record, but these discrepancies might not be immediately visible depending on which screen the clinician is viewing
• The patient whose name appears on the record may receive treatment intended for the other person, or vice versa

Overlap Display (Also Dangerous)

An overlap occurs when two records are linked (they share linkage relationships) but have different MPIIDs. In EMPI, if two records represent the same individual, they must have the same MPIID. An overlap violates this rule.

Display Implication: The display behavior for overlaps is more complex and depends on the specific query:

• If the clinician searches using demographics that match Record A, they retrieve Record A's MPIID and see all records linked to that MPIID
• If the clinician searches using demographics that match Record B, they retrieve Record B's MPIID and see a different set of linked records
• The same patient may appear as two different "people" in the system with partial data under each identity

This fragmentation means clinicians may lack access to critical patient information, leading to incomplete clinical pictures and potentially dangerous treatment decisions.

Duplicate Display (Lower Risk to Patient Safety)

A duplicate occurs when two records within a single data domain (the same facility) represent the same individual but have different MRNs. By default, duplicates are NOT linked in EMPI—they appear on the worklist with a link status of "non-link" and a link reason of "domain-conflict" if they have a high link weight.

Display Implication: Because duplicates are not linked and have different MPIIDs, they appear as separate patients in clinical systems. While this creates data quality issues and workflow inefficiencies, it is generally safer than overlay scenarios because:

• Clinicians see only one patient's data at a time (not a dangerous merge of two patients)
• The primary risk is incomplete information, not actively wrong information
• Duplicates should be sent back to the originating facility for MRN consolidation

Clinical User Perspective

It's important to understand that clinical users of systems like the UCR Clinical Viewer typically cannot detect overlay or overlap situations. The clinical interface doesn't display MPIIDs or linkage statuses—it simply shows patient data. Warning signs might include:

• Multiple different addresses, phone numbers, or emergency contacts
• Inconsistent demographic data (two different birth dates in different sections)
• Unusually large volume of medications or diagnoses
• Medications that seem contradictory (e.g., both insulin for diabetes and documentation of "no chronic conditions")

However, in busy clinical environments, these subtle discrepancies are often missed, especially if the clinician is focused on a specific acute problem.

---

The InterSystems EMPI Worklist displays record pairs that require human intervention to clarify linkage relationships. Understanding which categories present the greatest patient safety risk enables organizations to prioritize their worklist resolution efforts and assign the most qualified staff to the most dangerous conflicts.

The Five Linkage Conflict Categories

Record pairs appear on the Worklist due to linkage conflicts that fall into five categories:

1. Duplicate 2. Overlap 3. Overlay 4. Open-chaining 5. Deterministic

A record pair may belong to more than one category simultaneously.

Highest Priority: Overlay and Overlap

According to the InterSystems EMPI certification exam (sample questions Q12 and Q13), the two linkage conflict categories considered highest priority that ought to be handled by expert staff are:

Answer: Overlap and Overlay

These categories present the greatest patient risk because they result in incorrect data display in clinical systems, as described in the previous section.

Given the patient safety implications of various linkage conflict categories, healthcare organizations should implement strategic approaches to worklist management.

Expert Staff Assignment

Overlay and Overlap categories require the most skilled EMPI staff:

• Deep understanding of MPIID assignment and propagation
• Ability to use advanced tools (Linkage Graph, Whole Record Viewer, Record History)
• Critical thinking skills to analyze complex linkage scenarios
• Understanding of downstream impacts of unlinking decisions

Review and Validate categories (record pairs near thresholds) can be handled by less experienced staff:

• Straightforward comparison of demographic data
• Clear decision criteria based on similarity
• Lower risk of creating new conflicts

Deterministic categories require staff with technical knowledge:

• Understanding of deterministic identifier configuration
• Ability to coordinate with source systems for data correction
• Knowledge of linkage precedence hierarchy

Service Level Agreements (SLAs)

Organizations should establish SLAs for worklist resolution based on patient safety risk:

• Overlay/Overlap: Resolve within 24-48 hours
• Deterministic: Investigate within 1 week
• Duplicate: Communicate to source facility within 2 weeks
• Review/Validate: Resolve within 30 days based on link weight proximity to thresholds

Proactive Monitoring

Rather than simply reacting to worklist items, organizations should:

• Track worklist category trends over time
• Identify facilities or data sources with frequent duplicates or conflicts
• Investigate root causes (registration processes, system interfaces, data quality)
• Implement upstream corrections to prevent future conflicts

Staff Training and Quality Assurance

Regular training should emphasize:

• Real-world patient safety scenarios resulting from EMPI errors
• Proper use of "A is Different" vs. "B is Different" vs. "Same" vs. "Different" buttons
• When to escalate complex cases to senior staff
• Documentation requirements for manual linking/unlinking decisions

Quality assurance programs should:

• Audit a sample of manual linking/unlinking decisions
• Review adverse events for potential EMPI involvement
• Track and analyze EMPI-related help desk tickets from clinical users

---

Review documentation for detailed information.