The GUID Workbench

A global unique identifier (GUID) is a code that stands for one research participant in every study, registry, and biobank that person joins. This workbench explains why registries adopt one, how the codes are produced, where they are already in use, and what to ask a provider before families are invited to sign up. The exercises use invented people.

This workbench is under construction and has not been peer reviewed. It is an educational overview and not legal or security advice, and its program details were checked against the linked sources on October 7, 2026 and may have changed since then.

Why registries link records

People living with a rare disease often contribute to more than one research effort: a family-run registry, a natural history study at a clinic, a biobank, and sometimes a trial. Each effort assigns its own local ID, so one person exists as unrelated rows in separate data sets. Without a shared identifier, nobody can tell whether two data sets describe forty people or the same twenty people twice.

Family registrycaregiver surveys
Clinic studyvisit measurements
Biobankstored samples
The codes shown are invented and follow no real format.

What linking makes possible

  • An accurate count of people. Funders, sponsors, and regulators ask how many distinct people a community can reach, and overlapping data sets inflate that number unless each person is counted once.
  • A fuller picture of each participant. Outcomes reported by caregivers can be read beside clinic measurements, genetic results, and the samples held in a freezer.
  • Less repeated work for families. Information a family has already given can be reused by an approved study, so the same questionnaire does not have to be completed again.
  • Longer follow-up. A person who moves between clinics or joins a later study keeps one research identity, so earlier observations stay attached.
  • Entry to shared repositories. Some archives expect an identifier with each submission. The NIMH Data Archive, for example, asks for a GUID or a pseudo-GUID for the data it receives (EPINET guidance).

Limits to keep in view

A GUID links records only where it was captured and typed correctly, and a persistent code that follows a person from one data set to the next raises privacy questions of its own. The Linking exercise shows the first limit with invented data, and Risks and safeguards covers the second.

Words used on this page

In computing, a GUID is any 128-bit number generated to be unique. Health research borrowed the term for a participant identifier, and that second meaning is the one used here. Every abbreviation is spelled out in the glossary.

How identifiers are made

Research identifiers differ in whether the code is random or calculated from personal details, in who holds the list that connects a code to a person, and in whether the participant or the study site obtains the code. Every approach depends on the continuity of whoever issues the codes, so the same review questions apply to all of them. Select an approach to see how it works and what to check.

Try one-way hashing

Several of these approaches depend on a one-way hash, which is a calculation that turns text into a fixed-length code that cannot be run backward. The bench uses SHA-256 (Secure Hash Algorithm, 256-bit), a public standard, as a teaching example. Real systems choose their own fields, cleaning rules, and safeguards. Type only made-up details, although nothing entered here leaves your browser.

Cleaned text that gets hashed
Plain SHA-256 hash
Keyed hash, calculated with the secret key
  • The same details always give the same code. That property lets two sites recognize one person without exchanging a name.
  • A one-letter change gives an unrelated code. Select Change one letter to see why a typing error at one site creates a second research identity.
  • A plain hash can be guessed from a roster. Select Run a roster guess to see how someone holding a list of likely participants can hash each entry and look for a match.
  • A secret key blocks that guess. United States guidance on de-identification treats a code made by a hash function without a secret key as an identifying element, which is why linking services use keyed hashes or keep hash codes away from data recipients (HHS guidance).

Linking exercise

The data sets below belong to an invented rare disease community: a caregiver-entered registry run by Your Foundation, a natural history study at a clinic, and a biobank inventory. Every person is fictional. Choose a linking rule and compare what an analyst would report under each one.

Link records by

Reflection questions

Under the looser rule, a child is credited with a stored sample he never gave. What happened?

Jonah and Jonas Pike are twins, so they share a surname, a first initial, and a birth year. The looser rule merges them into one person, and the sample that belongs to Jonas is then attributed to the merged record. Rules loose enough to catch nicknames and typing errors are also loose enough to join relatives.

The GUID rule still counts one person twice. Which record is responsible?

The biobank logged sample BB-7005 without the identifier, so it cannot be joined to Priya Nair's registry record. A GUID links only the records in which it was captured. A required field with a format check, plus a routine report of records that lack an identifier, closes most of this gap.

Which problems did the GUID rule handle that neither name rule could?

It joined a hyphenated surname, a nickname, records labeled with an initial, and a birth date typed with the day and month swapped, and it kept the twins apart. It also recognized that two caregivers had registered the same child separately in the registry, because both entries resolved to one identifier.

Identifier systems in use

These examples are grouped by the kind of organization that runs them: government programs, academic and nonprofit programs, and private companies. Each entry says who runs the system, how the code is produced, and what the description rests on. This workbench is independent of every organization listed and describes each one only from the public sources cited, so a listing is not an endorsement and an omission is not a judgment.

Government programs

NIMH Data Archive GUID Hash-matched central IDUnited States. The identifier used for data submitted to the National Institute of Mental Health Data Archive (NDA).
Run by
The NDA, part of the United States National Institutes of Health (NIH).
How the code is produced
The NDA GUID Tool runs on the researcher's computer and converts the participant's details into one-way hash codes. Only the hash codes are sent to NIH, where they are compared with codes already on file. A match returns the GUID that person already has, and no match returns a new one.
Details supplied
Information as shown on a birth certificate, including the full legal name at birth, date of birth, sex, and city or municipality of birth. A Social Security number is not among the fields listed in the public instructions cited here.
Other points
The tool and its algorithms were released in 2010 after a collaboration among NIH, the Simons Foundation, and the informatics research community. When the birth details are incomplete, a pseudo-GUID serves as a random placeholder that can be converted to a GUID later.
Sources
NDA GUID Tool page, NIMH harmonization webinar, EPINET guidance on GUIDs and pseudo-GUIDs, National Neuropsychology Network user manual
NIH BRICS and the NINDS Centralized GUID Hash-matched central IDUnited States. One GUID server shared by several NIH institutes and programs.
Run by
The Biomedical Research Informatics Computing System (BRICS) at NIH, with a centralized server used by the National Institute of Neurological Disorders and Stroke (NINDS), the National Institute on Aging (NIA), and the Parkinson's Disease Biomarkers Program (PDBP).
How the code is produced
Software on the researcher's machine turns the participant's details into hash codes and sends only those codes to the GUID server. The program's documentation states that identifying details do not leave the researcher's machine and that a newly issued GUID is a random alphanumeric string.
Details supplied
Legal first, additional, and last names at birth, the day, month, and year of birth, and the city or municipality and country of birth. Sex at birth is optional.
Other points
The same toolset is documented by repositories such as the National Ophthalmic Disease Genotyping and Phenotyping Network (eyeGENE). A published evaluation of the GUID system examined how typing errors in the required fields cause a participant to go unrecognized.
Sources
NINDS Centralized GUID Server, BRICS page on GUID and record linkage, eyeGENE GUID instructions, JMIR Medical Informatics 2017 evaluation
NCATS GRDR and RaDaR Hash-matched central IDUnited States. Rare disease registry programs from the National Center for Advancing Translational Sciences (NCATS).
Run by
The NCATS Office of Rare Diseases Research at NIH.
How it used identifiers
The Global Rare Diseases Patient Registry Data Repository (GRDR) asked registry owners to assign a GUID to each participant so that de-identified data from different rare disease registries could be combined and connected to biospecimens. Its common data elements marked the fields needed to generate the identifier.
Status
The Rare Diseases Registry Program (RaDaR) grew out of GRDR and now offers guidance to patient groups on building registries. Its website states that RaDaR is not involved in collecting or storing patient data.
Sources
Rubinstein and McInnes, 2015, About RaDaR
N3C privacy-preserving record linkage Tokens and an honest brokerUnited States. A government-led program that works with a nonprofit broker and commercial software.
Run by
NCATS leads the National COVID Cohort Collaborative (N3C), and the Regenstrief Institute, a nonprofit, serves as the independent Linkage Honest Broker.
How the code is produced
Each contributing site uses Datavant software in its own environment to turn identifying details into tokens, which the broker's site describes as irreversible and usable only for linkage within the N3C project. The tokens go to the broker and are held apart from the clinical data in the N3C Data Enclave.
What linkage supports
The published account names deduplication, linking multiple data sets, and cohort discovery.
Sources
Regenstrief Institute page on record linkage, Tachinardi and colleagues
ERDRI.spider Context-specific pseudonymsEuropean Union. The pseudonymization tool of the European Platform on Rare Disease Registration.
Run by
The Joint Research Centre (JRC) of the European Commission, as part of the European Rare Disease Registry Infrastructure (ERDRI).
How it is used
The platform describes the tool as a service that gives participating registries a way to pseudonymize patients at the local level, alongside a directory of registries and a shared metadata repository.
Source
ERDRI description, European Commission

Academic and nonprofit programs

NeuroGUID in NeuroBANK Research network IDUnited States. An identifier for people taking part in research on amyotrophic lateral sclerosis (ALS) and other motor neuron disorders (MND).
Run by
The Neurological Clinical Research Institute at Massachusetts General Hospital, which manages the NeuroBANK platform.
How it is used
Participants in the ALS/MND Natural History Study are assigned a Neurological Global Unique Identifier (NeuroGUID) and a study-specific derivative called NeuroSTAmP. The study registration describes these as the means of linking the study's information to biological samples, images, and clinical data from other studies and trials in which the same people took part.
Sources
ClinicalTrials.gov NCT05966038, Mass General research blog on NeuroBANK
EUPID Services Context-specific pseudonymsEurope. European Patient Identity Services, used in pediatric oncology and rare disease research.
Run by
Developed at the AIT Austrian Institute of Technology, a research institute, within a European pediatric cancer research network, and first described in 2014.
How the code is produced
The services use hashing to recognize a returning patient and issue a different pseudonym for each context, such as a clinical trial or a biobank, while the master identifier stays hidden.
Reported use
In a peer-reviewed paper published in 2026, the developers report that as of July 2025 the central services held 6,356 unique patients for European pediatric oncology and had generated 10,340 pseudonyms across 12 contexts, with no false positive match detected so far. These figures are the developers' own report.
Sources
Frontiers in Digital Health, 2026, IRDiRC and GA4GH technology primer
CIBMTR Research ID Registry-assigned IDUnited States and international. The identifier for people reported to the Center for International Blood and Marrow Transplant Research (CIBMTR).
Run by
CIBMTR, a research collaboration in blood and marrow transplantation and cellular therapy.
How the code is produced
The identifier is assigned when a center registers a person who is receiving a cellular therapy such as a hematopoietic cell transplant. The registration form collects identifying details that include the legal name, date of birth, and place of birth, so that one person does not receive more than one identifier, and the reporting interface attempts partial matches before it creates a new registration.
Other points
The form instructions state that the identifying details are held within the assignment form and do not appear on later forms. CIBMTR abbreviates this identifier as CRID, the same abbreviation used for the Clinical Research ID listed under private companies. They are separate identifiers.
Sources
CIBMTR Research ID assignment instructions, CIBMTR reporting implementation guide
PCORnet record linkage Tokens and an honest brokerUnited States. The National Patient-Centered Clinical Research Network.
What is published
A peer-reviewed article describes a framework for privacy-preserving record linkage among electronic health record and administrative claims databases within PCORnet.
Source
PCORnet linkage framework article
Mainzelliste in the OSSE registry software Pseudonyms with a trusted third partyGermany. Open-source registry software for rare diseases, with a separate pseudonymization service.
Run by
Mainzelliste is an open-source service from Johannes Gutenberg University Mainz. The Open Source Registry System for Rare Diseases in the EU (OSSE) was financed by the German Federal Ministry of Health under the National Action Plan for Rare Diseases.
How the code is produced
The details that identify a patient are replaced by a pseudonym and stored separately in a patient list, which the published description says should be controlled by a trusted third party.
Sources
Muscholl and colleagues, 2014, IRDiRC and GA4GH technology primer

Private companies

Clinical Research ID (CRID) Participant-generated IDInternational. A code that a patient or caregiver creates and gives to the rare disease studies and registries they join.
Run by
CLIRINX, a private company that provides data collection software for patient registries and natural history studies (service website).
How the code is produced
The published description states that the identifier consists of 8 random alphanumeric characters and is created by the patient or a parent on the CRID website, which is available in several languages (peer-reviewed paper).
How it is used
The participant decides which research teams receive the code. The paper reports field testing across 6 rare disease research studies, in which the code was used to reuse a participant's documents and to transfer form data from the first study into later ones (peer-reviewed paper). The company's product page adds that researchers can validate a code and that outside research systems can connect through an application programming interface (company website).
What the service states
The website states that a CRID is free for patients and parents, optional for research studies, and approved by an IRB, and that participant information will not be sold or shared (service website). The paper's abstract states that patient data are encrypted in transit, at rest, and within the application (peer-reviewed paper). In June 2026 the company reported that more than 10,000 identifiers had been created (company news).
Further reading
Research programs and patient organizations publish their own instructions for participants. The Simons Searchlight page cited below is one example.
Sources
Nesbitt and Murphy, 2022, CRID website, CLIRINX product page, CLIRINX news, Simons Searchlight instructions
Commercial tokenization software Tokens and an honest brokerUnited States. Licensed software that turns identifying details into tokens for a broker to match.
Example in public documents
N3C uses software from the company Datavant. The honest broker's onboarding packet describes the tools as installed on the contributing site's premises, behind its firewall, with tokens that are specific to the project (documents published by the nonprofit broker).
Where it fits
The software produces the tokens, and a separate party such as an honest broker performs the matching under the governance of the research program.
Sources
Regenstrief Institute page on record linkage, N3C site engagement packet

National policy and other countries

Whether a country has a national health or personal identity number shapes how its registries link records. Where such a number exists and the law permits its use, registers can be joined directly. Where it does not, research programs issue their own identifiers or match on personal details. Select a place to see the identifier, the policy behind it, and published reading. The Timeline stage puts the same events in date order.

Comparison of national identifiers and research linkage in the places covered here
PlaceIdentifier for individualsHow research links records
United StatesNo national patient identifier. Federal spending to adopt one has been barred since fiscal year 1999.Program identifiers such as the NIH GUID, tokens matched by an honest broker, participant-generated codes, and matching on personal details.
DenmarkCPR number, issued by the Civil Registration System since 1968.National registers are linked directly by the CPR number.
SwedenPersonal identity number, introduced in 1947.National health registers are linked directly by the number.
England, Wales, and the Isle of ManNHS number, assigned at birth or first contact with the service.A 2015 law requires health and care organizations to use the NHS number as a consistent identifier.
AustraliaIndividual Healthcare Identifier, with uses limited by a 2010 law.Linkage centers match records on personal details and issue project-specific linkage keys.
Ontario, CanadaProvincial health card number.A nonprofit research institute encodes card numbers into coded key numbers before analysis.
European UnionSet by each member state.The European Health Data Space will grant access to pseudonymized data in secure environments, with rare disease tools such as ERDRI.spider and EUPID alongside.
Germany, rare disease registriesPseudonym issued by a separate patient list.A trusted third party holds the patient list, using the open-source Mainzelliste service.

Timeline of key events

This timeline places laws, regulations, government reports, proposed bills, and program launches in date order. Entries for the United States are marked in blue, entries for other countries in green, and international efforts in pink, and every entry also names its place and its kind. Use the filters to single out one kind of event, such as laws or government reports, and copy the entries shown into your own notes.

    Risks and safeguards

    Linkage errors

    A false split gives one person two identifiers, and a false merge gives two people one identifier. Splits usually begin with details typed differently at different sites. Programs reduce them by asking for details exactly as they appear on the birth certificate, by entering those details twice and comparing the entries, and by storing the GUID in a field that checks its format. Recording the reason whenever a GUID could not be obtained keeps the gap visible to analysts.

    A persistent code still points to a person

    In a small rare disease community, a code that follows a participant across data sets lets a recipient assemble more detail than any single data set reveals. Programs respond by sharing the identifier only under a data use agreement, by limiting which recipients receive it, or by issuing a different pseudonym for each context so that two releases cannot be joined without going through the service.

    The identity list

    Whoever holds the connection between each code and a real person holds the most sensitive asset in the arrangement. Designs differ on this point: some keep names with the enrolling site and send only hash codes onward, and others hold account details centrally. Knowing which design a provider uses is the starting point for any review.

    How regulators treat codes

    Under the HIPAA Privacy Rule, a covered entity may attach a re-identification code to de-identified data only if the code is not derived from information about the individual. HHS guidance adds that a code produced by a hash function without a secret key would count as an identifying element under the Safe Harbor method, and that an expert may find hash-derived codes acceptable when the keys are not disclosed (HHS guidance). In the European Union, the General Data Protection Regulation (GDPR) names pseudonymization as a safeguard and generally continues to treat pseudonymized data as personal data for anyone able to reverse it (GDPR text). Whether a given registry or identifier service falls under either law depends on who runs it and for whom, so that question belongs with counsel or the reviewing Institutional Review Board (IRB).

    Continuity of the provider

    Codes already stored in data sets keep working as labels if an identifier service stops, but new participants can no longer be issued codes or matched to earlier ones. This applies to every kind of provider. Government programs change with budgets and priorities: the GRDR repository, for example, gave way to RaDaR, which offers guidance and does not collect or store patient data (About RaDaR). Academic services often depend on grant renewal. For a company or a nonprofit, a sale, merger, or closure raises the question of who holds the identity list afterward. A public example from a different field is the 2025 bankruptcy of the consumer genetics company 23andMe, in which states objected to the transfer of customer data and the chairman of the Federal Trade Commission (FTC) wrote that the company's privacy promises should continue to apply to a buyer (news coverage, FTC letter). Written terms on continuity, notice, and deletion answer the question for any specific provider.

    Consent

    Participants can only agree to linkage they have been told about. Many programs state in the consent form that a code will connect the participant's data across named kinds of studies, who issues the code, which personal details are given to obtain it, and how to withdraw.

    Questions for an identifier provider

    These questions help a registry team review any identifier service before asking families to sign up, and they apply equally to a government program, a university, a nonprofit, and a company. The questions are grouped by topic and shown one group at a time. Record where each answer stands, add notes, and copy the summary into your vendor file. Your entries are saved in this browser only.

    Review summary

    Glossary and sources

    Glossary

    API
    Application programming interface, a way for one software system to request a service from another.
    CIBMTR
    Center for International Blood and Marrow Transplant Research. Its participant identifier is the CIBMTR Research ID.
    CPR number
    The personal identification number issued to residents by the Danish Civil Registration System.
    CRID
    Clinical Research ID, a participant-generated identifier for rare disease research run by the company CLIRINX. The same abbreviation is used for the separate CIBMTR Research ID.
    Crosswalk
    A list that connects one identifier to another, such as a study code to a name or a local ID to a GUID.
    De-identification
    Removing or transforming details so that data no longer identify a person. The HIPAA Privacy Rule offers the Safe Harbor method, which removes a set list of identifiers, and the Expert Determination method, in which a qualified expert documents that the risk is very small.
    Deterministic and probabilistic matching
    Ways of linking records without a shared identifier. Deterministic matching applies exact rules to fields such as name and birth date, and probabilistic matching weighs how strongly the fields agree.
    EHDS
    European Health Data Space, the European Union regulation that sets rules for using electronic health data in care and, under permits, in research.
    EHR
    Electronic health record.
    False split and false merge
    A false split assigns one person two identities. A false merge, also called a false match, assigns two people one identity.
    GAO
    Government Accountability Office, the audit and evaluation agency of the United States Congress.
    GDPR
    General Data Protection Regulation, the data protection law of the European Union.
    GUID
    Global unique identifier. In health research, a code that represents one participant across studies. In computing, any 128-bit number generated to be unique.
    HITECH Act
    Health Information Technology for Economic and Clinical Health Act of 2009, a United States law on health information technology and privacy.
    Hash, keyed hash, and salt
    A hash is a one-way calculation that turns text into a fixed-length code. A keyed hash mixes in a secret key so that only the key holder can reproduce the code. A salt is extra text added before hashing.
    HHS, CMS, and OHRP
    The United States Department of Health and Human Services and two of its offices: the Centers for Medicare & Medicaid Services and the Office for Human Research Protections.
    HIPAA
    Health Insurance Portability and Accountability Act, the United States law whose Privacy Rule governs health information held by covered entities and their business associates.
    Honest broker
    An independent party that performs linkage or holds identifiers so that analysts never see them. A trusted third party plays a similar role in European sources.
    IHI
    Individual Healthcare Identifier, the number assigned to people who receive health care in Australia.
    IRB
    Institutional Review Board, the committee that reviews research involving people to protect their rights and welfare. Australian sources use the term Human Research Ethics Committee.
    IRDiRC and GA4GH
    The International Rare Diseases Research Consortium and the Global Alliance for Genomics and Health, which ran a joint task force on privacy-preserving record linkage.
    ISO 27001 and SOC 2
    Widely used security assessments. ISO 27001 is a standard from the International Organization for Standardization, and SOC 2 (System and Organization Controls 2) is an audit report format from the American Institute of Certified Public Accountants.
    NHS number
    The 10-digit identifier given to patients of the National Health Service in England, Wales, and the Isle of Man.
    NIH, NIMH, NINDS, NIA, NCATS
    The National Institutes of Health and several of its institutes and centers: the National Institute of Mental Health, the National Institute of Neurological Disorders and Stroke, the National Institute on Aging, and the National Center for Advancing Translational Sciences.
    NPI
    National Provider Identifier, the 10-digit number that identifies health care providers in the United States.
    PII and PHI
    Personally identifiable information and protected health information.
    PPRL
    Privacy-preserving record linkage, a family of methods that link records using hash codes or tokens in place of readable identifiers.
    Pseudonym and pseudonymization
    A pseudonym is a code that replaces identifying details. Pseudonymization keeps the means of reversing it separate and protected. European sources spell the word pseudonymisation.
    Pseudo-GUID
    A random placeholder issued by NIH tools when a participant's details are too incomplete for a GUID.
    Token
    An encrypted code produced from identifying details by tokenization software, used for matching by an honest broker.

    Sources

    All links were opened on October 7, 2026, and each entry says what it was used to support. The sources are grouped by topic.

    Government identifier programs
    Academic, nonprofit, and company services, including the Clinical Research ID
    United States law and policy
    Other countries and international work