Probabilistic Matching, 4,100 Merges, 900 Complaints
Meridian Health Plan's MDM hub matches members across an enrollment system, a claims system, and a provider portal. The probabilistic match threshold is 0.85 with no manual review queue. Last quarter, 4,100 pairs above threshold were merged, and member services logged 900 complaints about explanation-of-benefit statements showing another person's claims; twins and shared-address families dominate the cases. Tightening the threshold to 0.95 would cut merges by roughly 30% and leave an estimated 12,000 true duplicates unmatched, which inflates the per-member cost calculations used in rate setting. The hub has no survivorship documentation; the current rule takes the most recently updated value per attribute, which caused a member's date of birth to be overwritten by a sibling's. Compliance is asking whether this is a reportable breach.
1. Analyse the false-positive versus false-negative trade-off and recommend a matching strategy that is more than just raising the threshold.
Read the worked answer
The threshold is one lever out of five, and the bluntest. Moving 0.85 to 0.95 trades one error class for another rather than improving the matcher.
Cost asymmetry, stated explicitly. A false merge puts another member's claims on an EOB - a privacy incident, a clinical risk (wrong blood type on file), and a complaint. A false negative leaves two records, which biases per-member cost and rate setting but harms no individual directly. For a health plan, false merges should be much rarer than false negatives - but not free, because 12,000 unmatched duplicates is a material actuarial error.
Recommended design.
- Tiered decisions, not a single cut. Auto-merge only above roughly 0.95 and with at least one corroborating deterministic identifier. Route 0.80–0.95 to a stewardship review queue with an SLA (for example 500 pairs per day across two reviewers). Auto-reject below the floor. The queue is what makes a high threshold affordable.
- Hard negative rules applied before scoring: different verified SSN, DOB differing by more than a year, different sex, mutually exclusive coverage periods. These catch the twin and shared-address cases directly.
- Better blocking so the candidate set is cleaner: block on SSN where present, otherwise last name plus DOB plus ZIP. Most false positives originate in weak blocking on common names.
- Measure the matcher. Label a stratified sample of about 1,000 pairs, compute precision and recall across several thresholds, and pick the operating point from the curve - not from a vendor default. Re-measure quarterly; quality drifts with enrollment sources.
- Never auto-merge on a single field. Confidence should combine weighted field agreement, with SSN and DOB weighted far above name.
2. Address the survivorship defect and advise compliance on whether the EOB disclosures are a reportable breach.
Read the worked answer
Survivorship. 'Most recently updated wins' is an entry convenience, not a survivorship rule. It guarantees that whichever system wrote last - including a bad manual update - becomes the golden record, and it destroys verified identifiers. That is how a DOB was overwritten by a sibling's.
Replace with attribute-level survivorship:
- Rank each source per attribute, not globally: enrollment is authoritative for legal name, DOB and SSN; claims for coverage history; portal for contact details.
- Protect a class of attributes (government ID, DOB, sex) as verified-only: overwritable only by a higher-ranked source or a stewardship action with evidence, never by recency.
- Retain the full cross-reference and attribute history in the hub; every change to a verified attribute logs before, after, source and actor.
- Publish the rules as hub metadata so consumers can see where a value came from.
Breach question. Do not answer it informally. An EOB showing another member's claims is a use or disclosure of PHI to the wrong individual and is at minimum an incident requiring a four-factor risk assessment: nature and extent of the PHI, the recipient, whether it was actually acquired or viewed, and the mitigation. Claims data on an EOB is not a low-risk category.
Facts to establish: how many of the 900 complaints involve actual disclosure versus a near miss, whether SSN or diagnosis codes appeared, and whether the 4,100 merges can be traced to specific members. Check the 60-day notification clock and any stricter state law. Separately, the DOB overwrite is a data integrity defect that may have propagated to eligibility checks - that warrants a clinical safety review, not only a privacy one.