The Swedish personal identity number: possibilities and pitfalls in healthcare and medical research.

Swedish health care and national health registers are dependent on the presence of a unique identifier. This paper describes the Swedish personal identity number (PIN) and explores ethical issues of its use in medical research. A ten-digit-PIN is maintained by the National Tax Board for all individuals that have resided in Sweden since 1947. Until January 2008, an estimated 75,638 individuals have changed PIN. The most common reasons for change of PIN are incorrect recording of date of birth or sex among immigrants or newborns. Although uncommon, change of sex always leads to change of PIN since the PIN is sex-specific. The most common reasons for re-use of PIN (n = 15,887), is when immigrants are assigned a PIN that has previously been assigned to someone else. This is sometimes necessary since there is a shortage of certain PIN combinations referring to dates of birth in the 1950s and 1960s. Several ethical issues can be raised pro and con the use of PIN in medical research. The Swedish PIN is a useful tool for linkages between medical registers and allows for virtually 100% coverage of the Swedish health care system. We suggest that matching of registers through PIN and matching of national health registers without the explicit approval of the individual patient is to the benefit for both the individual patient and for society.

Background

In 1686 the Swedish church started to keep local registers of parish members, and population statistics began in 1749 [1] (Personal communication: Marie Lennersand, 8th Jan, 2009). This enabled the church, and through the church also the Swedish state, to keep a population census and to enrol soldiers for the army.

The personal identity number (PIN) was introduced in 1947 and then consisted of date of birth and a three-digit number. From 1947 and onwards, every individual that has resided in Sweden on a permanent basis (and been recorded in the Total population register, TPR) has been assigned a PIN. In 1967, a check digit was added to the three-digit number. The check digit verifies that data of birth and the three-digit number are correct. In 1991, when the responsibility for the local population registers was moved from the local parishes to the local tax offices, the National Tax Board took over the full responsibility for the Swedish PIN. When the local population registers were computerized in 1967, Statistics Sweden established the TPR.

In 1997, the National Tax Board initiated a new notification system with partially new data. As of today (year 2009), all notifications are delivered from the National Tax Board to other administrations, including Statistics Sweden, on a daily basis. Statistics Sweden stores all notifications with updates in a notification database.

Although there are earlier accounts of the Swedish PIN system [2], these have seldom discussed the structure of the PIN in detail, and potential pitfalls of using the PIN in a medical or scientific context. The main purpose of this study was to examine the PIN from different angels with a focus on its use in Swedish health care and medical research. A second purpose was to explore ethical issues of the use of PIN in medical research.

Results

PIN in the total population register at statistics Sweden

The PIN is the unique identifier in the TPR [1]. The TPR includes data on name, place of residence, sex, age, civil status, place of birth (country, county, parish), citizenship, immigration (date, country, ground for settlement), and relations (married couples, child–parent). Until the year 2000, PINs were sometimes assigned also to individuals who had not entered into the TPR [3], but since that year individuals that do not qualify for a PIN receive a personal coordination number instead (see below). On Dec 31 2007 the total population of Sweden was 9,182,927. The estimated number of PIN’s in Sweden since 1969 is however, larger, and has been estimated to some 13,500,000 until Dec 31 2007 (Statistics Sweden).

Structure of the PIN

The PIN has three parts: date of birth, a three-digit birth number, and a check digit. The three-digit birth number is sex-specific.

Date of birth is listed as year, month, and day (e.g. 640823). This is followed by a three-digit birth number (e.g. 323) and a check digit (e.g. 4). The birth number can take on any value between 001 and 999. It is odd for men (e.g. 999) and even for women (998), i.e. the third digit is odd for men but never for women. The combination of a specific date of birth and a specific birth number will allow all Swedish individuals to have a unique PIN. Until the 1980s, the birth numbers could be linked to county of birth (not country of birth), but since 1990, birth numbers are drawn from a national pool of numbers. Between the date of birth and the birth number is a hyphen (“-”). The hyphen should in fact be changed into a plus sign the year an individual attains 100 years of age. This is to differ between individuals with the same birthday and same birth year but in different centuries. Hence individuals born in the 1900s (and being above 100 years old) and those born in the 2000s (below 100 years old) respectively should be listed as e.g. 010203+6578 and 010203-6578 respectively. However, the plus sign is seldom used, and in more and more IT systems the century is also included in the PIN (e.g. 19010203-6578).

The check digit is calculated according to the modulus-10-method, assigning alternating weights of two or one to the first nine digits of the PIN (Fig. 1). The purpose of the check digit is to check the correctness of the PIN, and such checks should always be performed prior to register linkages.

Fig. 1

Calculation of the check digit of the PIN. Each digit in the PIN is multiplied by 2 or 1 in alternating fashion. The products are summed up, but products consisting of two digits (*) are first summed up themselves (i.e. 12 = 1 + 2 = 3). In this case, the sum of products treated this way, is 36. # The last digit in the product sum (in this case 6) is extracted from 10 (the difference being “4”). If the product sum ends with “0” (e.g. 10, 20, 30, 40 etc.), the check digit “0” is assigned since “10” cannot function as the check digit

Assignment of the PIN

Every birth in Sweden must be reported to the Tax Board. The birth of a child is reported by the obstetric department, or if the birth takes place outside hospital, by the midwife, or if no midwife is present at the delivery, by the parents of the newborn child. According to Swedish law, the birth of the newborn child must be reported within 1 month after birth. It is estimated that 90% of all births and 93% of all deaths are reported to Statistics Sweden within 10 days, and 98 and 100% respectively within 30 days. A person who has once been assigned a PIN cannot have a new PIN other than for special reasons.

Immigrants without a PIN will also receive a PIN if they intend to stay in Sweden for at least 1 year. Immigrants who do not fulfil this criterion, but who e.g. are taxed in Sweden or who use the Swedish social security system will be assigned a coordination number.

Assignment of the coordination number

Coordination numbers were introduced in the year 2000, and are assigned to residents who are not registered in the TPR (mostly individuals that intend to stay in Sweden <1 year) [3]. These individuals do not receive a PIN. The coordination numbers are assigned by the National Tax Board, and enables different government agencies to collaborate around and identify individuals that stay in Sweden for a short time. In the years 2000–2007, some 350,000 individuals received a coordination number [3]. Uses of the coordination number include: tax payment, police registers, use of social security, seamen on a visit to Sweden, driving license purpose and car ownership, and diplomats. In the future, it is possible that diplomats residing in Sweden will also enter the TPR. The structure of the coordination number is very similar to that of the PIN, except that the value “60” is added to the day of birth digit. E.g. an individual born on the 13th of July 1969 will have a coordination number that begins with “690773” (13 + 60 = 73 on the “day of birth position”).

Although individuals with coordination number often frequent medical care, these individuals are not registered in the national health registers or in the TPR. Hence non-permanent residents with coordination numbers will not be sampled in national register studies in Sweden.

Judicial regulation of the PIN

All jurisdiction of the PIN can be found in the Population Registration Act §18 (1991:481).

Use of the PIN

When the PIN was established in 1947 it was primarily intended as an efficient means of identifying an individual. With the introduction of computerized national registers, the PIN has become a vital component of register linkages for research purposes [4-6], and is used as the key number in all national linkages. Today the PIN is extensively used in the public administration. In more and more medical research, the PIN is also used as the linkage tool between national register data and data collected through patient charts [7] or biobank data [8].

In health care, the PIN is used for vital statistics (date of birth, date of death), but it is also the unique identifier and the key variable when matching between different registers including The Patient Register (with inpatient and outpatient data), Cancer Register, Cause of Death Register, Medical Birth Register, and e.g. the National surveillance system of infectious diseases.

The most important use of the PIN in Swedish health care is however to trace patients and their medical records. The PIN enables efficient handling of referrals and referral letters, and is a means of identifying patients handled by different health care staff such as physicians, nurses, occupational therapists, physiotherapists etc. The PIN drastically reduces the risk of duplication errors, and can also separate the identities of same-sex twins. The PIN is also used as a marker for age. Traditionally individuals aged below 18 years are referred to the department of paediatrics, while adults are referred to departments primarily caring for adults.

Outside health care, the PIN is used for population statistics, migration, taxation, education, passports, income, and social security etc. It is also used for conscription purposes and by insurance companies. In real life, residents may be asked for their PIN for such various tasks as subscribing to a newspaper and hiring a car.

The vital statistics of Sweden is maintained by Statistics Sweden and updated daily regarding births, migrations, deaths, and marital status.

The PIN is the basis for efficient register linkages, and its use allows for easier (better) evaluations of Swedish health care, than in countries where residents lack a unique identifier.

Several authorities handle register linkages for health research purposes and the two major operators are Statistics Sweden and the National Board of Health and Welfare. Their areas of responsibility differ, and many register linkages involve both agencies (Figs 2, 3). Figure 2 presents the initial data linkage procedure in a project that examined the risk of multiple sclerosis among individuals with coeliac disease [9]. Figure 3 presents a possible linkage between cardiovascular morbidity data collected by a researcher and data from the national health registers. The linkage in Fig. 3 would enable the researcher to study cause-specific death, risk of cancer, risk of e.g. thyroid disease, and risk of adverse pregnancy outcome in patients with heart failure, myocardial infarction or stroke etc.

Fig. 2

Potential linkage between different registers involving patient identification from the National Board of Health and Welfare. ICD International Classification of Disease Code. (Used in the paper “A population-based study of coeliac disease, neurodegenerative and neuroinflammatory diseases” [9]). NBHW National Board of Health and Welfare. SS Statistics Sweden

Fig. 3

Linkage of own data. * Data collected by the researcher. # Matched controls identified by Statistics Sweden (Box 1). SS Statistics Sweden (Statistiska Centralbyrån, SCB). NBHW National Board of Health and Welfare (Socialstyrelsen)

Special conditions of the PIN

Incorrect PINs

Although Statistics Sweden and the National Board of Health and Welfare have systems to control PINs, the TPR contains incorrect PINs. An individual may receive an initial PIN that is incorrect, and although he/she might later receive a correct PIN, the individual’s PIN history is saved so that he/she can be traced over time. The number of erroneous PINs has been around 1,000 in the last 5 years. Most often, an individual with incorrect PIN has been assigned a “day of birth” that is not within the range 1–31, or a “month of birth” that is not within the range 1–12. Whenever an incorrect PIN is discovered, the individual will receive a correct PIN.

Re-use of PINs

Until January 2008 the number of re-used PINs was estimated at 15,887. A list of these PINs is stored in a special PIN re-use register. Re-use is highly restricted and subjugated to an extensive control. Although rare, re-use may be necessary for certain dates. This is especially so for PINs referring to the 1st of Jan and the 1st of July in the 1950s and the 1960s, since Sweden has experienced a large immigration of individuals born in these years and immigrants often have these days registered as their day of birth. In some countries the assigned date of birth is not as significant as in Sweden and the date of birth may be fictitious [3]. The two most common dates of birth, referring to PIN, among men registered in Sweden by the 31st of Dec 2007 are the 1st of July 1957 (N = 405) and the 1st of July 1956 (n = 385); and in women the 1st of Jan 1966 (n = 341) and the 1st of July 1955 (n = 315). As a consequence certain birthdays are more common than others. Among immigrants coming to Sweden in 2007, the most common birthdays were the 1st of Jan (n = 951), the 1st of July (n = 621), and the 2nd of Jan (n = 575). Birthdays also differ by country of birth, with 11.2% of all immigrated Turks registered in Sweden by the 31st of Dec, 2006 having their birthday on the 1st of Jan (immigrants from Syria: 5.7% and Somalia: 4.7%), while 9.4% of all Iraqi immigrants were born on the 1st of July. Some 0.2% of individuals born in Sweden have the 1st of Jan as their birthday (the 1st of July: 0.3%) [10].

If possible the National Tax Board tries to identify a PIN that has previously been assigned to an individual but never been used. A second possibility is to re-use a PIN that has only been used for a short time. Only when such PINs are unavailable will the Board consider the re-use of PINs of already dead individuals. Nevertheless, the re-use of PINs may have important implications for register linkages; and can potentially cause havoc for researchers that are unaware of PIN re-use.

To illustrate the re-use of PIN, a possible scenario is that individual A born on the 1st of July 1957 dies in 1979. In 2003, individual B (an immigrant) with the same date of birth (the 1st of July 1957) will be assigned the same PIN as individual A. All events in individual B then risk being assigned to individual A and seemingly occur after death. Patients with the same PIN may die twice, may be classified as primiparae in the Medical Birth Register on more than one occasion, may have different education background, may have had a large number of cancers (representing the cancer history of two individuals), may have had an appendectomy or hysterectomy twice according to the Patient Register etc. Similarly, the existence of incorrect PINs (albeit very uncommon) can potentially lead to males giving birth to children, and females having male-specific disease. More often such incongruities are however, caused by misclassification in the relevant health register, or introduced by the researcher himself/herself.

Aware of these pitfalls, Statistics Sweden has adopted safety measures to minimize the above pitfalls. Hence, two individuals with the same PIN (due to re-use of PIN) are nevertheless assigned different serial numbers in medical research (Figs. 2 and 3), and an individual who changes PINs (i.e. he/she has two PINs during life-time) will only have one serial number in datasets delivered from Statistics Sweden.

Change of PINs

Until January 2008, 75,638 individuals in Sweden had received a new PIN (therefore having had at least two PINs). PIN changes are documented in a special register.

The most common reasons for change of PIN are incorrect recording of date of birth or sex among immigrants or newborns. In adults, a difference between the true birth date and the birth date of the PIN may be of little importance. In children, where exact age is of greater importance, incorrect PINs are more often changed to reflect the true age of the child. According to guidelines issued by the National Board of Health and Welfare (Act 1993:11) the following age discrepancies motivate a change of PIN: 0–2 years: 6 months’ discrepancy; 2–9 years: 12 months; and 9–18 years: 24 months [11]. In this context, age discrepancy is that between age according to PIN and biological age according to an M.D. specialist in pediatrics [11].

The risk of assigning an incorrect PIN increases at times of large immigration when the immigrations system comes under stress. Change of PIN had until December 2006 occurred in 26,265 individuals born in Sweden (out of a total of 7,938,007; 0.33%). Change of PIN was most common in individuals born in Syria (3,164/17,768; 17.81%), Iran (5,272/55,747; 9.46%) and Turkey (2,432/37,108; 6.55%).

Change of sex is a very uncommon reason for change of PIN, so is protected identity. Change of PIN is only the third and ultimate step to protect a person’s identity in Sweden (the other two being “increased secrecy at administrative level” and “anonymous place of living”). When the need of protection is crucial (e.g. the survival of a threatened individual is at stake), the person is listed as emigrated and a person with the new PIN listed as immigrated (e.g. A Karlsson 1967xxxx-xxxx formally emigrates and then immigrates under a new identity (E Johansson, 1967yyyy-yyyy). Naturally these individuals do not have to leave the country physically. Knowledge of the connection between the old and the new PIN is only available to the highest administration of the Swedish Police Service. It has been estimated (exact data are not available), that some 20–30 individuals in Sweden have changed PINs due to protected identity. Medical events that occur after change of PIN are only attributed to a person’s last PIN.

PINs in the other Nordic countries

Many countries have PIN systems or similar systems, sometimes based on insurance numbers. Below is a short presentation of the PIN system in Denmark, Finland and Norway. Also Iceland has a PIN system.

Denmark

Danish citizens are assigned a ten-digit PIN where the first six digits represent day, month and year of birth (ex. 170669: day, month, year) and the last four digits constitute a control serial number [12]. Different years have different serial numbers. This makes it possible to identify the century of birth for the individual. Until the year 2007 the last digit served both as a sex-specific digit and a check digit. However, in 2007 the shortage of PINs in Denmark forced the authorities to a remake of the PIN, and check digits were scrapped. This vastly increased the potential number of PINs that can be assigned to Danes. In Demark, not only residents but also Danish individuals living outside Denmark may have a Danish PIN if they fulfil certain criteria.

Finland

The Finnish PIN is made up of 11 characters. The first six digits represent date of birth, but is then followed by “+” if the person was born in the nineteenth century, by “-” if the person was born in the twentieth century, and “A” if the person was born in the twenty-first century. After the first seven characters follows a sex-specific three-digit number and lastly a check digit. All Finnish citizens receive a PIN, but as opposed to in Denmark and Sweden, also short-term residents (stay <1 year) in Finland can request a PIN to facilitate interaction with government agencies. Finnish authorities do not use coordination numbers.

Norway

The Norwegian PIN consists of 11 characters beginning with day, month and year of birth (e.x. 130498—for an individual born on the 13th of April 1998). One exception to this rule is when the birth date of an immigrant is the 1st of Jan and it is suspected that the birth date is actually not the 1st of Jan. Under such circumstances, the immigrant can be assigned a PIN that instead corresponds to the date of immigration.

The hyphen in the Norwegian PIN is followed by a five-digit control number.

Norway also uses coordination numbers (D-Numbers). Coordination numbers are assigned to individuals that in some way do business in Norway, pay taxes in the country or own Norwegian property etc.

Discussion

This paper describes the Swedish PIN. The Swedish PIN consists of the date of birth, a three-digit birth number and a check digit. The PIN is of great importance in Swedish society and is extensively used in routine health care as well as in medical research. It is the foundation for all large-scale medical register linkages. Similar PIN systems are used in Finland, Denmark, Norway and Iceland [3].

The large number of individuals with (true or wrongly assigned) birth dates in the 1950s and 1960s illustrates the risk of a shortage of PINs. Due to the current construction of the PIN, there are a maximum of 500 male and 499 female PINs, and it has been estimated that in 5 years PINs referring to certain days of births will not be available [3]. Also in the future, will Sweden and other counties face large numbers of migrants with birthdays on the 1st of Jan and the 1st of July.

Increased awareness of the high stress on the current PIN system has led to a government investigation on the future structure of the PIN. Given that a lot of the digital infrastructure in Sweden is conditioned on a 10–12 digits PIN (12 digits when the PIN includes the century), the Swedish Council of Legislation is currently considering a change of law, that would allow future immigrants for which there are no PINs corresponding to their birth date, to be assigned a PIN where the “day position” corresponds to a date just before or after his/her actual birth date. Information on the exact date of birth would, however, be stored separately in the TPR. There are no plans to change existing PINs or the structure of the coordination numbers [3].

The presence of incorrect and/or re-used PINs among Swedish residents constitutes a potential pitfall for Swedish medical researchers and health care workers. Matching between large datasets where individuals with identical PIN occur more than twice in both datasets may result in mismatching with risk of incorrect data. Unawareness of the fact that medical events in one individual may have been attached to two or three different PINs will result in an underestimation of morbidity. These problems can be solved through an active communication between the researcher, Statistics Sweden and the National Board of Health Care at time of register linkage. However, it is also recommended that the medical researcher scrutinize the delivered dataset with respect to e.g. age and calendar year distribution, as well as the number of positive outcomes to detect possible errors.

Ethical aspects on the use of PIN

The main reason for using the PIN in the Swedish health care is to promote the medical care of individual patients. Such care includes investigation and treatment for a vast range of disorders, some life-threatening (e.g. Crohn’s disease or a traffic accident) while others only qualify as mild complaints (having a cold). To manage patients effectively, especially over time, physicians need a unique identifier. The patient with Crohn’s disease may develop fistulas. Through the PIN an earlier history of hypersensitivity to Infliximab is easier to trace, and the physician may then choose a more appropriate treatment than Infliximab. Comparison of spinal x-rays in a patient who has suffered from a traffic accident, and the x-rays taken 6 weeks earlier on the day of trauma, may yield crucial information on the prognosis of the patient. It is unquestionable that access to stored medical data through the use of the PIN is of great importance to the diagnostics, and treatment of many patients.

But the PIN also allows medical data to be used for educational purposes, research and quality assurance schemes. Large medical databases such as the Swedish Cancer Register or the Swedish Patient Register, built around the PIN, create additional value to society. The PIN enables researchers to merge such registers and to examine an array of questions, including the long-term consequences of preterm birth [13] or certain diseases [14], the medical consequences of alcohol abuse [15], or the association between a medical event and human behaviour [16]. Hence, the PIN allows researchers to estimate morbidity and mortality in patients. Such research will not only optimize health care resource allocation but more importantly improve the management of both current and future patients. Through the PIN it is possible to trace virtually any patient. The medical outcome of a patient (e.g. with increasing age a prostate cancer may become obvious) can be used to evaluate sensitivity and specificity of new diagnostic techniques tested on both historic and new blood samples. Finally, the natural course of disease (as recorded in registers and patient charts) serves to educate medical students.

The fact that historic medical data often benefit the patient him-/herself is an important reason why individual patients cannot withhold or withdraw their medical data from the national health registers, or request that such register data be anonymised (i.e. that all links to their PIN is deleted). Such rights would harm both medical care and the quality of medical research. Considering that withholding data is not an option for Swedish patients it is difficult to estimate the proportion of individuals who had this been possible would have requested anonymisation, deletion or restricted use of their medical data. However, in a study on patient’s refusal to consent to storage and use of samples in Swedish biobanks [17] only 1 in 690 patients objected to the storage and use of such data for research purposes, and even fewer were willing to complete a dissent form. Although a refusal of 1/690 individual will not affect study power in medical research, such refusals may cause some bias since they are unlikely to be non-differential with regards to background factors, socioeconomic status, ethnicity, and morbidity.

According to current Swedish regulation, the use of national register data for research purposes does not require informed consent. We argue that the current situation benefits patients and society, and that informed consent should not be required for large-scale medical research. A number of arguments can be put forward to defend this ethical position (equally relevant to biobank data [18]).

(1) Some patients will not understand the consequences of their objections to the use of register-based health data. (2) The impossibility to acquire the approval of everyone would reduce the statistical power of most studies. (3) There is an obvious risk that consent would be especially difficult to obtain in high-risk groups where positive outcomes are most frequent, in children, and in immigrants with limited knowledge of the Swedish language. This conflicts with the principle of justice and equality [19] that stipulates that individuals should not be discriminated against due to inability to consent or to understand the meaning or need of medical research. (4) Relatives may find questions on the use of medical data from their “dead mother or father” for research purposes lacking in respect. (5) The costs of obtaining the consent of millions of patients with health data would be exorbitant and prohibit most large-scale research. The cost is however not always a valid argument, and in small-scale register-linkages it may be feasible to seek patients’ consent before carrying out the study. Finally (6), it should be remembered that the public is not without voice in matters of any medical research (including that based on the PIN). When a register contains identifiable data (through the PIN, name or any other unique identifier), each individual has a right to obtain a copy of his/her data in that register. Furthermore, it is preferable to inform the public of large-scale ongoing research projects through the media, including what groups of people are being involved (e.g. men born between 1913 and 1923).

Hence, it may be concluded, that although large-scale register-based studies do not routinely involve personal consent), researchers in Sweden are nevertheless expected to protect the integrity of participating individuals and meet the demands of study participants whenever possible.

Whenever register-based data based on the PIN will be used, the medical project is reviewed by an Ethics review-board. This review-board is a guarantor that the rights of individuals incapable of consent (e.g. children and older people) are protected. Although, the review-board will allow most PIN-based register-linkages, the PINs of the merged data will almost without exception be removed and replaced by unique serial numbers by the National Board of Health and Welfare or Statistics Sweden before being delivered to the researchers. Furthermore the researchers are obliged to sign a contract where they agree to secure storage of the data-set, and never to back-track the identity of patients in the anonymised data-set. We suggest these precautionary measures are sufficient to protect the integrity of patients, and that informed consent should not be needed when performing large register-based research.

Conclusions

In conclusion, the Swedish PIN serves as a unique identifier in Swedish health care, and in many other areas of the Swedish society. Furthermore, the PIN is the key variable in all large register linkages in Swedish medical research. Together with (1) the comprehensive national public health system that represents close to 100% of all Swedish health care; and (2) the National health registers, the PIN is the pillar of register-based medical research in Sweden. The benefits of using the PIN in medical research override the potential harm.