Encrypting personal identifiers

STUDY SETTING. A statewide patient discharge database contained only one unique identifier: the social security number (SSN). A method was developed to transform (encrypt) the SSN so that it could be made publicly available, for purposes of linking discharge records, without revealing the SSN itself. The method of encrypting the SSN into a Record Linkage Number (RLN) is described. PRINCIPAL FINDINGS. The same RLN will always result from the same SSN; it is highly improbable that the same RLN would be produced by two different SSNs; the SSN cannot be derived from the RLN, even given access to the encryption program; the encryption method cannot be determined through knowledge of a number of SSN/RLN combinations; and the method can be described, evaluated, and adapted for use by other researchers without compromising confidentiality of the RLNs resulting from the method.