7 false merges per 1,000 is the overlay risk hiding inside your duplicate-rate target

In February 2026, BMJ Quality & Safety published a propensity-matched cohort study with an uncomfortable result. Patients with duplicate medical records were 5 times more likely to die after being admitted to hospital and 3 times more likely to require intensive care than those with a single medical record. Six months later, Sens. Mark Warner (D-VA) and Jim Banks (R-IN) introduced the MATCH IT Act of 2026, legislation that would direct HHS to set national standards for measuring how often patients are correctly matched to their medical records. On the same weekend, TEFCA's IASIASThe global accounting rulebook that governs how companies report financial results, used across the EU and 140+ jurisdictions.View full definition → Exchange Purpose Implementation SOP v3.0 took effect on 3 August 2026, which means more inboundinboundA strategy that attracts prospects organically via valuable content (blog, SEO, social) rather than interrupting them.View full definition → records arriving for your registration and HIM teams to file against the right chart. The clinical evidence, Congress and national exchange volume now all point at the same number: your duplicate rate.

That is where the danger starts. The fastest way to push a duplicate rate down is to auto-merge more aggressively, and every wrong merge is an overlay: two different people sharing one chart. Overlays are rarer than duplicates, harder to see, and far worse to unwind. My thesis is simple. Patient identity is a system with two kinds of error, and a duplicate-rate target that has no overlay ceiling next to it is a patient safety hazard. Your matching thresholds should be set by the overlay cap, and the duplicate rate should be whatever falls out of that.

How should a hospital system resolve patient identity across EHRs?

Set the overlay ceiling first. Then standardize demographics, match deterministically before you match probabilistically, link records across systems without physically merging them, and treat every overlay as a safety event. Here is the sequence.

1. Measure both error rates before touching a threshold

Run your EHR's potential-duplicate report, then sample merges completed in the last twelve months and have HIM staff adjudicate them. Most organizations know their duplicate backlog and have no idea how many of their past merges were wrong. Track the full set of four: duplicate rate, overlay rate, merge backlog, and the time from detection to correction.

Write down your own definitions, because nobody else has fixed them for you. The House version of MATCH IT says outright that there is no standard definition across the health care system of "patient match rate" to ensure the ability to accurately measure patient matches and patient misidentification. The baseline is rarely flattering: Pew's 2018 work found matching accuracy within health care facilities is as low as 80%, while accuracy between organizations can be as low as 50%, even when those organizations share the same electronic health record (EHR) vendor.

2. Set a two-number target: a duplicate rate and an overlay cap

On duplicates, the American Health Information Management Association (AHIMA) identifies a 1% duplicate rate as an achievable benchmark for healthcare organizations implementing proper data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition →. On match rate, the 2026 Senate bill sets a 99.9% aspiration, and CMS would create a voluntary bonus measure within the Medicare Promoting Interoperability Program, paying an adjustment to providers who reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → a 90 percent match rate. Read the bill's fine print: nothing in it shall be construed to require an entity to meet a minimum patient match rate of 99.9 percent.

The overlay cap is the number you add yourself. I recommend no more than 1 false merge per 1,000 automated merges, measured by sampling, which matches the 99.9% figure Congress is already using.

3. Standardize demographics before you tune the algorithm

Matching algorithms can only work with the data registration gives them. The Pew and Regenstrief research from 2019 is still the cleanest evidence: combining addresses in the USPS format with last name standardization produced as much as a 10 percentage point improvement in match rates, from 81.3 to 91.6 percent, which cut the number of unlinked records by half. Registration itself causes errors too. ECRI's analysis found about 13 percent of the identification errors were made during patient registration. Address validation at the front desk is cheaper than any EMPI upgrade.

4. Run deterministic matching first and probabilistic matching second

Deterministic rules are precise and miss a lot. When researchers tested England's HESID linkage algorithm on paediatric intensive care data, it had a low false match rate (0.2%) but a high missed match rate (4.1%), and deterministic followed by probabilistic matching is the best solution for reducing missed matches, particularly in scenarios where errors in patient identifiers are more common.

Probabilistic matching fills in what deterministic rules miss, but it brings false merges with it. The OneFlorida network, part of PCORnet, reported a precision of 97.25∼99.7% and a recall of 75.5%. In its validation run, out of the 1000 individuals that were matched based on the 2 linkage rules, 7 were false positives (ie, a precision of 99.3%). Deduplication still mattered a great deal: it reduced the population by 10.79%, to 15 143 179 patients.

Tune thresholds for each source system rather than using one setting for everything. Intermountain did this as far back as 2005, using an algorithm that allows the threshold limits for the returned set to be dynamically assigned to the source system, and for internal hospital systems, the rate of duplicate creation was cut 30% in the first 6 months. The study is two decades old. The design principle still holds.

5. Link across systems and merge only inside one

Across hospitals, acquired practices and inbound HIE feeds, keep a cross-reference in the EMPI (registry style) and leave the source charts as they are. Physical merges in the EHR should be reserved for adjudicated pairs inside a single system. This is the registry-versus-consolidation choice frommaster data managementmaster data managementMaster Data Management (MDM) is the discipline of creating and maintaining a single, consistent, trusted version of an organization's core business entities like customers, products, and suppliers.View full definition → styles, and in a provider setting it decides how much damage a wrong match can do: a bad link can be removed, but a bad merge mixes notes, orders and results into one chart.

Exchange rules are moving the same way. The AHA objected in April 2026 that the proposed SOPs rely on untested consent and patient matching components, presenting significant compliance risks for responding nodes that are covered entities. The final version removed references to "TEFCA IAS Consent" workflows and associated patient matching methodologies, retaining the ability for providers to verify requests for access and use of data. Where a patient presents a verified credential, use it as a high-weight attribute: CMS's Interoperability Framework says queries should be fulfilled automatically and, when feasible, in real-time, including through use of IAL2 credentials to support identity matching.

6. Treat every overlay as a patient safety event

Route confirmed overlays through your patient safety organization reporting, not the HIM ticket queue. ECRI's review of 7,613 wrong-patient events found about 9 percent led to temporary or permanent harm or even death. In one of the deaths, the wrong patient's documentation was used to give another patient clearance for surgery. That analysis dates from 2016, and nothing about EHR architecture since then has made the failure mode less likely.

The overlay also lands on three compliance desks. HIPAA counts one patient seeing another's results in the portal as an impermissible disclosure that needs a breach risk assessment. The CMS conditions of participation require accurate medical records. Claims billed against the wrong coverage create overpayments that have to be found and returned.

The 1-in-1,000 rule for auto-merge thresholds

Here is the rule to write on the whiteboard. Auto-merge only in score bands where sampled precision is at least 99.9%. Send everything from that line down to the cost breakeven to a human reviewer. Below breakeven, leave the records split and linked.

The breakeven comes from remediation costs. According to figures that Staffingly, a registration-services vendor, attributes to AHIMA, each duplicate costs up to $1,000 to correct, and an overlay, where two patients' records are wrongly merged, costs up to $5,000 each to untangle. Treat those as orders of magnitude, given where they come from.

Worked example (hypothetical, arithmetic only). A health system runs a cleanup that auto-merges 20,000 candidate pairs:

• At OneFlorida's validated 99.3% precision, 140 of those merges are overlays. At up to $5,000 each, that is up to $700,000 of remediation before counting any harm.
• At 99.9% precision, it is 20 overlays and up to $100,000.
• For a single pair, merging is worth it on cost alone when the chance of a true match times $1,000 saved exceeds the chance of a false match times $5,000 lost. That works out to a match probability above 5/6, about 83%.

So in this example, pairs scoring between roughly 83% and 99.9% go to HIM review, and pairs below 83% stay split. The cost figures leave out clinical harm, and the BMJ study shows duplicates cause harm as well, so do not let anyone use this arithmetic to justify leaving a duplicate backlog alone. Put your reviewer hours into the middle band, where an algorithm is most likely to be confidently wrong.

Patient matching pitfalls that turn cleanup into harm

Reporting merge counts as success. "12,000 duplicates resolved this quarter" tells the quality committee nothing unless the number of wrong merges among them is reported next to it. Report both, every time.

Using one global threshold. Emergency department registrations (trauma aliases, unidentified patients), newborns and twins, and acquired-practice imports each have their own error profile. Intermountain's per-source thresholds were the point of its design.

Ignoring who gets missed. Missed matches do not fall evenly across the population. In England, HESID's missed matches biased the true readmission rate, particularly for some patient groups including ethnic minorities. If your readmission or risk-adjustment numbers feed value-based contracts, those biased misses end up in your revenue. Track missed-match rates by demographic group.

Migrating duplicates into a new EHR. After a merger, reconciliation starts with a master patient index strategy that resolves duplicate and conflicting patient records across the two systems. Clean the identity data before conversion. Fixing it afterwards means fixing it in production.

Merging without a tested unmerge. If your EHR's unmerge has never been run in a test environment, you have no way to recover from an overlay. Test it.

Pointing AI at unresolved charts. Sponsors now argue that patient matching is a prerequisite for AI in healthcare. A summarization agent reading an overlaid chart will produce a fluent, confident summary of two people. MIT Sloan Management Review's recent essay on the AI governance paradox looks to nuclear plants and air traffic control, where safety depends on operating discipline as much as on the technology. Identity resolution is that kind of discipline for clinical AI. Build overlay detection, for example impossible clinical combinations or two conflicting blood types in one chart, into yourclinical data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → scorecard before any agent goes live.

What to do on monday

• Pull every merge from the last 90 days, randomly sample 200, and have two HIM analysts adjudicate them independently. That gives you your first measured overlay rate.
• Ask your EMPI vendor for the current auto-link threshold for each source system and the precision measured at that threshold. If they cannot produce it, suspend auto-merge below the top score band until they can.
• Add overlay rate and detection-to-correction time to the quality and patient safety committee dashboard, next to duplicate rate.
• Run an unmerge on a test pair in your non-production EHR environment and record how long it takes and what fails to separate.
• Turn on USPS address standardization at registration and at every patient-portal intake form.
• Name one accountable owner for patient identity. In practice that means the HIM director, with the CMIO and CDO co-signing threshold changes.
• Check how inbound TEFCA and HIE documents are filed. Any document with an identity conflict should go to a hold queue, not into the closest-matching chart.

The cheapest identity error is the overlay you never create. If you measure false merges this week and set your thresholds by that number, the duplicate rate will still fall, without anyone ending up in someone else's chart.

The full course on this sector:Data in Healthcare Providers.