Can AI link fragmented health records without a patient ID?
A peer-reviewed Brazilian study matched death, hospital and notification records with very high accuracy in one state. Its shared blocking-and-labelling pipeline means nationwide performance is still unproven.
The short version
- What happened
- The study processed 250,989 death records, 11,534 hospital records and 116,369 notifications from Espírito Santo, reducing about 32.1 billion possible comparisons to 4,035,046 candidate pairs.
- Who it affects
- More reliable linkage could reveal care pathways and injury patterns that fragmented databases currently miss.
- What remains unproven
- The reference labels were drawn from the same blocking universe used by the model, so true pairs missed by blocking are invisible.
Keep in mind
The reference labels were drawn from the same blocking universe used by the model, so true pairs missed by blocking are invisible.
Validation used the same linkage and manual-review procedure rather than a different health system with an independent identity standard.
The study covered one smaller Brazilian state and may not generalise to larger, more heterogeneous populations.
Reviewer agreement was not quantified, and the identifiable source data cannot be independently reproduced publicly.
Source analysis · 2 linked sources. Primary analysed source date: 2 October 2026.
Read the full report · 7 min The evidence, methods, implications and limitations
The problem is administrative fragmentation, not diagnosis
Brazil's public-health systems contain mortality records, hospital admissions and mandatory notifications that can describe different parts of the same person's experience. Those records do not always share a dependable unique identifier. Names can be abbreviated, accents omitted, dates mistyped and people can move. Linking them incorrectly can attach one person's admission or injury report to another person's death record; failing to link them can hide a care pathway from epidemiological analysis.
The TRAUMA project study tests a supervised classifier for that matching task. It does not diagnose trauma, predict death or make a treatment decision. Its job is to classify pairs of administrative records as belonging to the same person or not, using name, mother's name, date of birth and sex plus derived similarity measures. The practical benefit would be better population evidence, but direct identifiers make privacy and false matches central concerns.[1][2]
One Brazilian state supplied three national-system extracts
The methodological validation used records for adults living in Espírito Santo who died between July 2018 and June 2025. The state has 78 municipalities and an estimated population above 3.8 million in 2022. Researchers processed 250,989 mortality records, 11,534 hospital-admission records and 116,369 violence, poisoning and occupational-accident notifications. The hospital extract represented records supplied through the state data flow, not every admission in Brazil's national DATASUS database.
Four blocking passes used phonetic encodings of first names and mothers' names, birth year and sex to avoid comparing every record with every other record. That reduced an estimated 32.1 billion possible pairs to 4,035,046 candidates, a 99.987% reduction. Blocking makes the work computationally feasible, but it also defines what the classifier can see: a true pair excluded by every blocking pass can never be recovered by the later machine-learning stage.[2]
The classifier focused on uncertain pairs
The operational pipeline automatically treated aggregate similarity scores of at least 90% as matches and scores below 65% as non-matches. Pairs in between were sent to supervised classification. Features included Jaro–Winkler and Levenshtein name similarity, components of birth dates, source database and how common a name was. Missing mothers' names were retained with an intermediate similarity value; a separate missingness-flag analysis changed F1 by only 0.00010.
Model development used 106,363 labelled pairs: 74,454 for training and 31,909 for testing. There were 17,362 matches and 89,001 non-matches, approximately one positive for every five negatives. Several algorithms were evaluated, and Light Gradient Boosting Machine produced the strongest overall result. The authors prioritised precision because a false link can silently contaminate multiple variables and subsequent analyses.[2]
Performance was very high inside the evaluated pipeline
In the held-out test pairs, ROC-AUC was 0.99996, sensitivity 0.99731, precision 0.99464, specificity 0.99895 and F1 0.99597. Precision–recall AUC was 0.99980 and the Matthews correlation coefficient was 0.99519, both useful checks under class imbalance. Birth-date features and name-similarity measures contributed most strongly in the SHAP analysis; uncommon names generally increased confidence while frequent names reduced it.
A training-independent validation set contained another 80,159 pairs, including 12,404 matches. F1 remained 0.99252, with sensitivity 0.99016, precision 0.99490 and specificity 0.99907. Raising the classification threshold improved precision while reducing sensitivity. That trade-off matters in practice: a system designed to avoid false joins will knowingly miss more true links, and the right balance depends on how the resulting database will be used.[2]
The conventional comparison was competitive
The researchers compared TRAUMA with CIDACS-RL, an established probabilistic method. On 5,037 candidate pairs available to both systems, the machine-learning approach's F1 was higher by 0.01236, with a paired-bootstrap 95% confidence interval from 0.00921 to 0.01590. CIDACS-RL maintained very high precision, while TRAUMA recovered more reference links and recorded higher sensitivity, F1 and specificity in the evaluated sets.
That is not the same as proving broad statistical superiority. Each method's blocking rules generate a different candidate universe, and aggregate scores can hide which people were recovered or missed. The team manually reviewed additional pairs produced only by CIDACS-RL and removed duplicates before comparison. The paper appropriately concludes that both approaches were robust in this setting and frames the differences as observed performance, not universal ranking.[2]
The gold standard shares the model's blind spot
The most important limitation is that the reference set was constructed from candidate pairs produced by the same blocking strategy used by TRAUMA. True matches excluded at blocking are unobserved, so pair completeness cannot be estimated. Manual labels were assigned independently by two experienced reviewers with disagreements resolved by consensus, but initial agreement was not quantified with Cohen's kappa or another statistic.
The validation set followed the same probabilistic-linkage and manual-review procedure as model development. It was new data, but not an external health system with independently established identities. Espírito Santo's smaller population may also produce fewer coincidentally similar names than larger states. The original Soundex algorithm was designed for English names, not Brazilian Portuguese, and performance may fall where spelling variation, missingness and population heterogeneity are greater.[2]
Privacy protection is part of whether the method is usable
Direct identifiers were stored in a restricted institutional cloud environment, accessed through a protected network and VPN, and could not be copied to unauthorised devices. The underlying records are not public because of ethical, legal and privacy restrictions. Those controls are necessary, but the study does not evaluate security incidents, re-identification risk, operational access auditing or how long identifiers should be retained after linkage.
The work was funded through Brazil's public-health institutional-development programme in partnership with Hospital Israelita Albert Einstein. Authors declared no competing interests. For public agencies, the result supports a controlled external pilot, not automatic nationwide deployment. Any production use should audit false links across racial, linguistic, regional and migration groups and measure how linkage errors alter the epidemiological estimates produced downstream.[2]
What would change the assessment
Confidence would rise with validation in several larger Brazilian states and a national extract, using an independently constructed identity standard that can reveal matches missed during blocking. Researchers should report pair completeness, reviewer agreement, error rates by identifier quality and demographic subgroup, and downstream changes in mortality or injury estimates. Prospective operational testing should also compare staff time, manual-review burden and security controls.
The paper shows that supervised classification can automate a costly uncertain-pair stage with excellent measured performance in one real administrative setting. It does not yet show that nearly perfect scores survive a different blocking system, a more populous state or a national database. That distinction matters because even a small false-link rate can affect many people when hundreds of millions of comparisons sit behind a public-health analysis.[2]