title: Checking Questionable Entry of Personally Identifiable Information Encrypted by One-Way Hash Transformation.
abstract: BACKGROUND
  As one of the several effective solutions for personal privacy protection, a global unique identifier (GUID) is linked with hash codes that are generated from combinations of personally identifiable information (PII) by a one-way hash algorithm. On the GUID server, no PII is permitted to be stored, and only GUID and hash codes are allowed. The quality of PII entry is critical to the GUID system.
  
  
  OBJECTIVE
  The goal of our study was to explore a method of checking questionable entry of PII in this context without using or sending any portion of PII while registering a subject.
  
  
  METHODS
  According to the principle of GUID system, all possible combination patterns of PII fields were analyzed and used to generate hash codes, which were stored on the GUID server. Based on the matching rules of the GUID system, an error-checking algorithm was developed using set theory to check PII entry errors. We selected 200,000 simulated individuals with randomly-planted errors to evaluate the proposed algorithm. These errors were placed in the required PII fields or optional PII fields. The performance of the proposed algorithm was also tested in the registering system of study subjects.
  
  
  RESULTS
  There are 127,700 error-planted subjects, of which 114,464 (89.64%) can still be identified as the previous one and remaining 13,236 (10.36%, 13,236/127,700) are discriminated as new subjects. As expected, 100% of nonidentified subjects had errors within the required PII fields. The possibility that a subject is identified is related to the count and the type of incorrect PII field. For all identified subjects, their errors can be found by the proposed algorithm. The scope of questionable PII fields is also associated with the count and the type of the incorrect PII field. The best situation is to precisely find the exact incorrect PII fields, and the worst situation is to shrink the questionable scope only to a set of 13 PII fields. In the application, the proposed algorithm can give a hint of questionable PII entry and perform as an effective tool.
  
  
  CONCLUSIONS
  The GUID system has high error tolerance and may correctly identify and associate a subject even with few PII field errors. Correct data entry, especially required PII fields, is critical to avoiding false splits. In the context of one-way hash transformation, the questionable input of PII may be identified by applying set theory operators based on the hash codes. The count and the type of incorrect PII fields play an important role in identifying a subject and locating questionable PII fields.
authors.affiliation: Institute of Information Security and Big Data, Central South University, Changsha, China.
authors.forename: Xianlai
authors.identifier: http://orcid.org/0000-0002-4338-015X
authors.initials: X
authors.lastname: Chen
authors.affiliation: Intramural IT and Bioinformatics Program, Division of Intramural, National Institute of Neurological Disorders and Stroke, National Institutes of Health, Bethesda, MD, United States.
authors.forename: Yang C
authors.identifier: http://orcid.org/0000-0003-2636-2002
authors.initials: YC
authors.lastname: Fann
authors.affiliation: Division of Computational Science, Center for Information Technology, National Institutes of Health, Bethesda, MD, United States.
authors.forename: Matthew
authors.identifier: http://orcid.org/0000-0002-2409-5126
authors.initials: M
authors.lastname: McAuliffe
authors.affiliation: Sapient Government Services, Arlington, VA, United States.
authors.forename: David
authors.identifier: http://orcid.org/0000-0002-1533-8683
authors.initials: D
authors.lastname: Vismer
authors.affiliation: 7th Ward, Xiangya Hospital, Central South University, Changsha, China.
authors.forename: Rong
authors.identifier: http://orcid.org/0000-0003-1433-9606
authors.initials: R
authors.lastname: Yang
keywords: computer security; confidentiality; data accuracy; medical record linkage; personally identifiable information; privacy; quality control; registries