Personally identifying information such as name or date of birth (DOB) are not retained beyond the time that it takes to conduct a match between data sets. Before analysis, individual records are stripped of the identifying information (e.g. name, DOB). The redacted record containing relevant information is retained only for the duration of the analysis as approved and specified in the Data Sharing Agreement.