Counting the Uncounted: Privacy-Preserving Linkage for Public Health Proof of concept

U.S. Census Bureau Emerging Technology (xD) Fellowship / eHealth and Northwestern University CAPriCORN network

Problem

Public health research depends on linking people across datasets, connecting someone’s record to their Census responses to see how neighborhood conditions shape chronic disease. This could surface insights about populations long underrepresented in health research, but the infrastructure to do it safely does not exist at scale.

The two organizational systems involved set hard constraints: Census data is protected under Title 13, health records under HIPAA, and the Bureau’s matching outputs are possible links needing human review, creating unacceptable exposure of patient identity.

The cultural system encoded in the health data revealed the problem: people most likely to lack an SSN in their record tend to be the unhoused, low-income, and undocumented. A linkage built on identifiers available to the well-documented would reproduce the erasure the research tries to correct. The lever is to establish that a person in one dataset is the same as in another without relying on SSNs — linkage methods that depend on SSNs tend to underperform for populations less likely to have one on record, biasing match accuracy against exactly the groups this effort aims to include.

Solution

I began by mapping what the lever touched and what a good ending looked like for Bureau and health researcher stakeholders before designing anything.

This mapping informed the record linkage design for pilot testing VaultDB using existing Bureau and University infrastructure. This Secure Multiparty Computation tool lets institutions compute across each other’s data without exposing it, enabling linkage between Census ACS data and EHRs held by Northwestern’s ORION network.

After evaluating honest-broker tools (Linkja, Datavant) and a possible Phase 2 pathway, my core recommendation was to move from a probabilistic linkage method to one without human review to avoid disclosure of health record data. A deterministic matching method or a hybrid of deterministic and probabilistic methods, paired with the right honest broker, is fairer by design for populations less likely to have SSNs.

Impact

This pipeline would let researchers query across Census and EHR data which neighborhoods pair social determinants of health with high chronic disease, without either institution sharing its data, defensible under Title 13 and HIPAA. It ultimately serves patients who stay invisible in cross-institutional research because the infrastructure to include them safely does not yet exist.

My biggest takeaway was respect for governance as the real work: the technical path proved tractable, but I finished without a Phase 2 honest-broker solution I could confidently defend. Naming that gap was an important insight. The review layer that once seemed like friction is what makes public data trustworthy, and shipping a tool is not the same as shipping a safe one for vulnerable people between these two complex organizations.

The next phase needs a formal privacy review of externally-assigned PIKs, data-standardization coordination between Census and clinical partners, and community health advocates at the table to help frame test queries using the pilot pipeline.

Stack & Methods

VaultDB (Secure Multiparty Computation) · privacy-preserving record linkage · honest-broker evaluation (Linkja, Datavant) · deterministic and hybrid matching methods · Census ACS data · Northwestern ORION electronic health records · Title 13 / HIPAA compliance · U.S. Census Bureau Emerging Technology (xD) Fellowship · eHealth and Northwestern University CAPriCORN network.

AI assistance: Claude (Anthropic) for drafting/editing this description and for code.