FHIR Master Patient Index Patterns: What Fails at 5M+ Patient Scale

MPI systems that work cleanly at 500k patients start showing scale-related failure modes at 5M+. The patterns below come from health-system deployments where the Patient resource volume crosses the point where naive record-linkage assumptions break.

Deterministic matching hits false-positive walls. At 500k patients, deterministic rules on identifier + birthDate + name.family catch 92-95% of matches cleanly. At 5M, exact matches on those three fields alone produce false positives — twins sharing family names, transposed birth dates, common last names. The threshold where deterministic breaks: about 2M patient records in most real populations.

Probabilistic scoring needs empirical weight calibration. Textbook probabilistic MPI (Fellegi-Sunter) assumes match probability weights that reflect your actual population's field distinctiveness. Off-the-shelf weight tables from vendor documentation don't reflect regional name/birthdate distributions. Recalibrate weights against your own labeled dataset — a labeled training set of 10-20k pairs is enough to see 3-5 percentage points of accuracy lift.

Referential integrity during merges. When two Patient records merge, dozens of downstream FHIR resources (Encounter, Observation, Condition, MedicationRequest) point at the old ID. FHIR supports Patient.link for this, but query-time link resolution has cost. Batch update patterns that walk the entire chart at merge time perform better under read load. The US Core Patient profile covers what fields must survive a merge.

Death registry reconciliation. State death registries update quarterly; MPI systems that don't reconcile flag deceased patients as active for months. Automate the reconciliation.

Vendor comparison, mid-2026

MPI at 5M+ patient scale is genuinely operational work — not a one-time deployment. Teams that treat it as such have significantly cleaner charts a year in.