# Lesson 9: Data Sources and Data Linkage

*Companion-podcast transcript, Sarah and Kiffer*

---

**Sarah:** Welcome back to Office Hours. I'm Sarah.

**Kiffer:** And I'm Kiffer. This week we are talking about data that already exist, where they are kept in Canada, how you get permission to use them, how records from different places are joined together, and how the people in those records are protected.

**Sarah:** So far in the course, the data have mostly been things a team collects itself. Surveys, chart reviews, interviews. What changes this week?

**Kiffer:** What changes is that someone else created the data, for a different reason. A hospital records a diagnosis so it can treat the patient and get paid, and years later a researcher counts those records. That is secondary use. It opens up enormous populations, and it comes with rules, paperwork and delays.

**Sarah:** Let's anchor it in our running case. Remind people about Cedar Valley.

**Kiffer:** The Cedar Valley Social Connection Study is fictional. A team led by Dr. Maya Hart is working with the fictional Cedar Valley Health Authority in British Columbia. They surveyed sixteen hundred adults aged sixty-five and older, and three hundred and ninety-two of them, about a quarter, scored as lonely on the three-item loneliness scale. One of their questions asks whether loneliness is associated with emergency department visits.

**Sarah:** And the survey can tell them who is lonely, but it cannot tell them who went to the emergency department.

**Kiffer:** Exactly. The health system already records each visit, so the team needs to find where those records live, apply for access, link them to the survey answers of people who agreed, and keep the linked file safe. Those four steps are the four sections of the lesson.

**Sarah:** Then let's start with where the records live. Who holds health data in Canada?

**Kiffer:** It follows from how health care is organized. Provinces and territories deliver most care, so they create and hold most records of physician visits, hospital stays, prescriptions and insurance registrations. Nationally, there are two big players. Statistics Canada runs the census and a large program of surveys. And the Canadian Institute for Health Information, which everyone calls CIHI, collects records from the provinces and territories and organizes them to common national standards.

**Sarah:** The reading also introduces a set of roles. Custodian, steward, platform. Those sound similar.

**Kiffer:** They do. The custodian is the organization legally responsible for holding and protecting the data, such as a ministry of health. The steward is the person or body that decides, on the custodian's behalf, whether a particular request should be approved. The platform prepares data, links records and provides a secure place to analyze them. And the researcher is the person accountable for using the data only as approved.

**Sarah:** Let's take Statistics Canada first. What does it offer a health researcher?

**Kiffer:** Mostly surveys and the census. The Canadian Community Health Survey is the big one. It asks people aged twelve and older living in private households about their health and use of care, and it includes a question on sense of belonging to the local community. The census describes small areas, including how many older adults live alone.

**Sarah:** The reading describes three levels of access to Statistics Canada data. Walk me through them.

**Kiffer:** The first level is published tables, which are free on the website. The second is the public use microdata file. That is one record per respondent, with identifying details removed or coarsened, so ages might be grouped and geography might stop at the province. Students can usually get those through the university library under the Data Liberation Initiative. The third level is the confidential master file, with all the detail, and that is only available for approved projects inside a Research Data Centre.

**Sarah:** What actually happens at a Research Data Centre?

**Kiffer:** Research Data Centres sit on more than thirty university campuses, run through a partnership called the Canadian Research Data Centre Network. You submit a proposal explaining why you need the confidential data. If it is approved, you go through a security screening and you are sworn in as a deemed employee of Statistics Canada, which puts you under the same confidentiality obligations as the agency's own staff. You work on computers that cannot send files out, and every result you want to take away is checked by Statistics Canada staff first. There is now also a virtual option for remote work under similar controls.

**Sarah:** Could the Cedar Valley team use any of this?

**Kiffer:** For context, yes. Census tables could describe how many older adults in the region live alone, and the community health survey could compare community belonging in British Columbia with other provinces. But neither can answer the main question, because there is no way to join a Statistics Canada file to the Cedar Valley survey responses.

**Sarah:** What about CIHI? What makes it useful?

**Kiffer:** Standardization. Hospitals across the country code diagnoses and procedures the same way, so a hospital stay for pneumonia looks the same in Nova Scotia as in British Columbia. CIHI holds the Discharge Abstract Database for hospital stays and the National Ambulatory Care Reporting System for emergency department visits, along with databases on continuing care, home care and prescriptions paid by public drug programs.

**Sarah:** Is there a catch with the emergency department data?

**Kiffer:** One that matters for comparisons. Coverage of emergency departments in that reporting system differs between provinces, so before you compare provinces you check which sites and years actually report.

**Sarah:** So why doesn't the Cedar Valley team just ask CIHI for the emergency visits?

**Kiffer:** Because they need to attach each visit to a particular survey respondent. CIHI's record-level files are de-identified and are not usually linked to a researcher's own survey. The province holds the same kinds of records together with the personal health numbers that make linkage possible. So studies that need linkage usually go to a provincial data centre.

**Sarah:** Which in British Columbia means Population Data BC.

**Kiffer:** Population Data BC, or PopData, is hosted at the University of British Columbia. For many years it has helped researchers request, link and analyze administrative data from British Columbia, including Ministry of Health files on physician services, hospital discharges, prescriptions and registrations. Importantly for Cedar Valley, it can link data researchers collected themselves, such as survey answers, when participants explicitly agreed to the linkage on a consent form that meets the data providers' requirements.

**Sarah:** The reading says the arrangements in British Columbia have been changing.

**Kiffer:** They have. In twenty twenty-four the Ministry of Health began accepting academic requests through something called the Health Data Platform BC, and since August twenty twenty-five, new research projects that want Ministry of Health data go through a shared PopData and Health Data Platform process. Analysis is also moving to a cloud-based trusted analysis environment. Students should check the current process before planning anything.

**Sarah:** And other provinces have their own versions?

**Kiffer:** Yes. ICES, which began as the Institute for Clinical Evaluative Sciences, holds linked, coded health data for Ontario. The Manitoba Centre for Health Policy maintains a population research data repository at the University of Manitoba, and Health Data Nova Scotia does similar work at Dalhousie University. Other provinces and territories have their own arrangements.

**Sarah:** What happens if a study wants to compare provinces?

**Kiffer:** That is harder than it sounds, because record-level health data usually have to stay in the province where they were collected. One answer is distributed analysis. The team writes one protocol and one set of analysis code, analysts in each province run it locally, and only the summary results are combined. Health Data Research Network Canada also helps, through a hub that gives researchers a single entry point and a common request form for data from more than one region.

**Sarah:** The last part of section one covers cohort studies and data governed by First Nations organizations.

**Kiffer:** Some data were created for research from the start. The Canadian Longitudinal Study on Aging follows more than fifty thousand adults who were between forty-five and eighty-five when they joined, with its own access process. And the First Nations Regional Health Survey is run by the First Nations Information Governance Centre and held under the principles of ownership, control, access and possession that we covered in Lesson four. In Cedar Valley, the fictional Cedar Valley First Nations Health Centre takes part in decisions about any data on its members.

**Sarah:** So, section two. The team knows where the data are. How do they get them?

**Kiffer:** Through a data access request. Administrative health data cannot be downloaded. You write a formal application, the people responsible for the data review it, and you get access only for the approved purpose.

**Sarah:** And when does that process begin?

**Kiffer:** Earlier than students expect. The Cedar Valley team wrote linkage into its consent form and asked for personal health numbers in the survey itself. Of the sixteen hundred respondents, one thousand three hundred and twelve consented to linkage and gave a health number. That group becomes the study population for the request.

**Sarah:** What are the stages?

**Kiffer:** There are typically eight. An enquiry and intake meeting with data access staff. A feasibility check, where you confirm the data exist for your people and years, and a cost estimate. Ethics approval. Submitting the request. Review by the data stewards, who often come back with questions. Agreements, confidentiality undertakings and privacy training. Then the platform links the data and releases them into a secure environment. And finally analysis, checking of outputs, and closing the project. Requests often loop back when a reviewer asks for changes.

**Sarah:** What goes into the request itself?

**Kiffer:** Think of it as a short proposal written for data stewards. It states the purpose and the public benefit. It defines the study population in terms the provider can actually apply. It lists each data set, the years and every variable, with a justification. It explains the linkage and the consent, names everyone who will see the data, and describes the secure setting and the planned outputs.

**Sarah:** You keep saying the population has to be something the provider can apply. What does a bad one look like?

**Kiffer:** Something like older adults in the region. A data provider cannot turn that into an extract. The Cedar Valley version is precise: the one thousand three hundred and twelve survey respondents who consented to linkage and gave a personal health number, and nobody else.

**Sarah:** And then there's data minimization.

**Kiffer:** That principle runs through everything. You ask for only the people, years and variables the question needs, in the least identifying form that will work. The Cedar Valley team asked for age in years instead of full date of birth, and the health service area instead of the postal code. They left out the names of physicians, because the question does not need them. It also makes approval easier.

**Sarah:** Who reviews the request?

**Kiffer:** Several groups, each from a different angle. Data stewards ask whether the use is lawful under the privacy law and agreements governing each data set, whether it serves the public, and whether the request is minimal. The research ethics board reviews the study under the Tri-Council Policy Statement, and that policy has a specific article, five point seven, on data linkage. It requires ethics approval before linkage and asks you to describe the data and the chance that linkage creates identifiable information.

**Sarah:** And the First Nations partner?

**Kiffer:** Indigenous governance bodies have authority over data about their communities. In Cedar Valley, the health centre reviewed the request, agreed with the team on how results about First Nations participants would be reported, and asked to see those results before release. The university also signs the research agreement, because it takes on legal obligations too.

**Sarah:** Let's talk about time. How long does all this take?

**Kiffer:** Months. Population Data BC describes the process as one that can take some months, and requests with several providers or new linkages tend to take longer. The Cedar Valley team built in about a year from the intake meeting to the start of analysis, and they checked that assumption with data access staff.

**Sarah:** So what do you tell a researcher who wants linked provincial data for a study that must finish in a few months?

**Kiffer:** I tell them gently that it is very unlikely to work. A better plan for a short study is to write the request as a proposal and analyze a public use file in the meantime, or to join an existing approved project.

**Sarah:** And costs?

**Kiffer:** Platforms commonly charge fees to recover the cost of preparing and linking data and running the secure environment. Research Data Centres can involve fees, and so can custom requests to CIHI. You also need analyst time and time for everyone's privacy training. Getting a cost estimate at the feasibility stage means you can put it in a grant application.

**Sarah:** Section three is record linkage. Start with a definition.

**Kiffer:** Record linkage means bringing together records that belong to the same person from different sources, or from within one source. It is what lets a loneliness score sit beside an emergency department visit.

**Sarah:** The reading has some history.

**Kiffer:** A little. Halbert Dunn, an American vital statistician, used the term in nineteen forty-six, imagining a book of life for each person. Then Howard Newcombe and colleagues, working in Canada, showed in nineteen fifty-nine that a computer could link birth and marriage records by weighing agreement on names and other details. And Ivan Fellegi and Alan Sunter, at what is now Statistics Canada, gave probabilistic linkage its mathematical form in nineteen sixty-nine. Fellegi later became Chief Statistician of Canada.

**Sarah:** There's a distinction between a match and a link that I found helpful.

**Kiffer:** A match is a pair of records that truly belongs to one person. A link is our decision to treat a pair that way. Ideally they line up perfectly. Linkage error is whatever gap remains between them.

**Sarah:** What identifiers do we have to work with?

**Kiffer:** In British Columbia, the best is the personal health number, a lifetime identifier for everyone registered for provincial health insurance. Records also carry names, a date of birth, sex and a postal code. Every one of those can disagree between two records of the same person. Someone transposes digits, a surname is spelled MacLeod in one place and McLeod in another, William becomes Bill, a day and month get reversed, or the person moves.

**Sarah:** And those errors don't hit everyone equally.

**Kiffer:** They don't. People who move often, people whose names are often misspelled or transliterated from another alphabet, and people who have changed their names are more likely to have records that disagree. That matters for Cedar Valley, because older adults who recently moved to a smaller town are one of the groups the team cares about.

**Sarah:** Let's do the worked example. Deterministic linkage first.

**Kiffer:** Deterministic linkage joins two records when they agree exactly on a specified key. Our rule is simple: link if the personal health numbers are identical. We have six pairs of records, each pairing a survey record with a hospital record. Pairs one, two and four link. Pair two links even though the surname is spelled differently, and pair four links even though the given name and postal code differ, because the rule only looks at the health number.

**Sarah:** And pair three?

**Kiffer:** Pair three is the same woman, Margaret Chen, but she transposed two digits when she wrote her health number on the survey. The rule misses her. That is a missed match. Pairs five and six are different people, twin sisters and a married couple, and the rule correctly keeps them apart because their health numbers differ. A second pass on surname, given name, birth date and sex, which is called stepwise linkage, would pick Margaret up.

**Sarah:** Now probabilistic linkage. This is where people's eyes start to glaze over.

**Kiffer:** It is simpler than it looks. Imagine the hospital file had no health numbers, so we compare names, birth date, sex and postal code. Each identifier gets two probabilities. The m probability is the chance it agrees when the records really belong to the same person. That is a bit below one, because of typing errors and nicknames. The u probability is the chance it agrees by coincidence for two different people.

**Sarah:** Give me an example of a high and a low u.

**Kiffer:** Sex has a u of about one half, because half of all random pairs share a sex. A full date of birth among older adults has a tiny u, because two different people rarely share one. Software turns the ratio of m to u into a weight on a logarithmic scale so that you can just add the weights up. In our example, agreeing on birth date adds about eleven points, while agreeing on sex adds one point.

**Sarah:** And when things disagree?

**Kiffer:** Disagreement weights are negative. Then you add everything up for each pair. The team linked pairs scoring fifteen or more, rejected pairs below five, and sent the ones in between to clerical review, where a trained person looks at the records and decides.

**Sarah:** How did the six pairs come out?

**Kiffer:** Pair one, where everything agrees, scores thirty-one point three. Pair two loses some points for the surname spelling but still scores over twenty and links. Pair three now links with full marks, because the health number plays no part. Pair four scores twelve point nine and goes to review, and the reviewer accepts it, because Bill is short for William and the postal code shows a move within the region.

**Sarah:** And the twins?

**Kiffer:** The twin sisters live together. They agree on surname, birth date, sex and postal code, and only their given names differ. They score twenty-one point five and are linked automatically. That is a false match, two different people treated as one. The married couple, by contrast, disagree on birth date and sex and score just below zero, so they are correctly rejected.

**Sarah:** Could you change the thresholds to catch the twins?

**Kiffer:** If you raised the upper threshold to twenty-five, the twins would go to review, and a reviewer would probably notice the different names. The cost is more pairs to check by hand, because pair two would go to review as well. Moving thresholds always trades one kind of error against another.

**Sarah:** How do we measure how well a linkage did?

**Kiffer:** Two measures. Sensitivity is the proportion of true matches that were linked. Positive predictive value is the proportion of links that are true matches. In our tiny example, the health number rule found three of four true matches with no false ones. The probabilistic approach found all four but made one false link. Six pairs are far too few to judge a method, but that is the general pattern, and many linkage units combine the two approaches.

**Sarah:** Why should a student care about linkage error if they never run the linkage themselves?

**Kiffer:** Because it changes the data they analyze, and they cannot see it. A missed match makes a person look as if they had no visits, so events are undercounted. A false match attaches someone else's visits. And if the errors fall unevenly on the groups being compared, the comparison is biased.

**Sarah:** The reading has an illustration with the Cedar Valley numbers.

**Kiffer:** It does, and it is clearly labelled as illustrative. Suppose ninety of the two hundred and ninety-eight consenting lonely respondents, about thirty percent, and two hundred of the one thousand and fourteen others, about twenty percent, truly had an emergency visit. That is a gap of ten and a half percentage points. Now suppose a weaker linkage misses ten percent of the lonely group's visits, because they moved more often, and three percent of everyone else's. The observed gap shrinks to about eight points. Roughly a quarter of the association disappears, purely because of the linkage.

**Sarah:** There was also a point about consent.

**Kiffer:** Only people who consent can be linked, and in the Cedar Valley survey lonely respondents consented less often, about seventy-six percent compared with about eighty-four percent of others. So the linked file under-represents lonely older adults before any algorithm runs. The team reports that as a limitation.

**Sarah:** How did the real Cedar Valley linkage turn out?

**Kiffer:** In our fictional world it went well, because it used health numbers. Ninety-nine percent of consenting respondents were linked, and nine were not. Five of those nine were lonely, which is a small error leaning in the same direction as the illustration, so the team reported it.

**Sarah:** What can researchers do about all this?

**Kiffer:** Ask the linkage unit for information about quality, such as the methods used and how linkage rates differ between groups. Compare the people who linked with those who did not on every variable you have. Look for impossible records, like a hospital stay after a death. Repeat the analysis under different assumptions to see whether the conclusion holds. And report the linkage properly, following the reporting guideline for studies that use routinely collected health data, which is called RECORD.

**Sarah:** On to section four, privacy safeguards. Why does a linked file need special protection?

**Kiffer:** Because it reveals more than any of its sources. The survey says how lonely someone feels. The health records say when they went to the emergency department and why. Together they form a detailed account of a person's life, which people shared on the understanding that it would be protected.

**Sarah:** Start with identifiers. What's the difference between direct and indirect?

**Kiffer:** A direct identifier, like a name or a health number, identifies a person on its own. An indirect identifier, also called a quasi-identifier, does so only in combination. A date of birth, a postal code, a rare diagnosis. Latanya Sweeney estimated that about eighty-seven percent of people in the United States could be singled out by just ZIP code, sex and full date of birth. And the risk grows in small places. In Cedar City, a ninety-one-year-old woman who visited the emergency department in March is one of many. In a small community like the fictional Kestrel Lake, a neighbour who knows those few facts might recognize her.

**Sarah:** What techniques reduce that risk?

**Kiffer:** De-identification is the umbrella term. You remove direct identifiers. You replace identities with codes, which is called pseudonymization. You generalize, so age in years replaces a birth date and a health service area replaces a postal code. You suppress rare values, for example grouping everyone over ninety-five. And you release counts for groups instead of individual records.

**Sarah:** The separation principle seemed especially clever to me.

**Kiffer:** It rests on a simple observation. Linkage needs identifiers, and analysis needs health content, but nobody needs both. So identifiers go to a linkage unit that sees no health information, and it assigns each person a study number for that project only. The health content travels separately without names. Researchers end up seeing study numbers and content, and never the identities.

**Sarah:** Then the Five Safes.

**Kiffer:** The Five Safes framework came from Felix Ritchie and colleagues, out of work on secure data access at the United Kingdom's Office for National Statistics. It asks five questions. Is the project appropriate? Can the people be trusted? Does the setting prevent unauthorized use? Could the data themselves identify anyone? Could the outputs?

**Sarah:** Do all five have to be at maximum strength every time?

**Kiffer:** No, and that is the useful part. They work as a set. A public use microdata file has very safe data, because the detail has been stripped out, so it can be analyzed on an ordinary computer. A confidential master file keeps the detail, so it needs screened people, a secure setting and checked outputs. And the framework sits alongside privacy law, ethics policy and Indigenous data governance.

**Sarah:** What does a secure research environment look like in practice?

**Kiffer:** Usually a remote virtual desktop. You log in with strong authentication, you can analyze the data, but you cannot download it, email it or copy and paste it out. Your activity is logged. Everything that leaves goes through one controlled route, and that is where output checking happens.

**Sarah:** And output checking catches what?

**Kiffer:** Small cells, mainly. A table cell with two people in it can identify them. Many organizations require counts below a threshold, often five, to be suppressed or combined, though the exact rule depends on the organization. It also catches differencing, where two tables that look safe on their own let you subtract one from the other and recover a small number. And extreme values, because a maximum often belongs to one person.

**Sarah:** The Cedar Valley table was a nice example of that.

**Kiffer:** The research assistant made a table of respondents with three or more emergency visits, by loneliness and community. Five of the cells were between one and four. If you only blank out those five, people can work some of them back from the totals. So the team combined Riverside, North Bench and Kestrel Lake into other communities, and every cell reached five or more. They also sent anything about First Nations participants to the health centre for review before release.

**Sarah:** Which brings us to the data management plan. What does this lesson add to it?

**Kiffer:** A section called data sources, linkage and safeguards. First, it says whether the study would use any existing data, and if so, who holds them and the general route to request access. Second, it says whether anything will be linked, and the consent form must ask permission for that. Third, it includes a five-row Five Safes table for the study, modelled on the Cedar Valley plan.

**Sarah:** And if a study only uses interviews the team runs itself?

**Kiffer:** The table still applies. It describes how names are kept apart from transcripts, where the files will be stored, who will see them, and how quotations and small numbers in the results are kept from identifying anyone.

**Sarah:** Any last advice?

**Kiffer:** Treat the organizations in this lesson as real but changing. I have described them in general terms, and for any real project, their current guidance and their data access staff are the authority. Next week, in Lesson ten, we move to interviews and focus groups, using the Cedar Valley team's twenty-four interviews as our guide.

**Sarah:** Thanks, Kiffer. And thanks to everyone for listening to Office Hours.

**Kiffer:** Thanks, Sarah. See you next week.