Two design traditions dominate warehousing. Inmon (2005) advocates an integrated, normalised enterprise warehouse from which subject-specific marts are derived. Kimball and Ross (2013) build the warehouse directly as a set of dimensional models tied together by conformed dimensions, meaning dimensions such as patient or date that carry the same keys and meaning wherever they are used. The dimensional route delivers usable results one business process at a time, which suits a network that must show value early. Its discipline lies in declaring the grain of each fact table, that is, exactly what one row represents, before anything else is designed.

Health informatics has produced its own analytical models. The i2b2 platform stores observations in a single fact table keyed to patient, encounter, concept and time (Murphy et al., 2010), and the common data model evaluated by Overhage et al. (2012) standardises both table structure and vocabularies so that the same analysis can run at many sites. These models are optimised for research cohorts. A network that also needs operational reporting on beds, theatres and waiting times will want process-specific fact tables as well, though it should borrow their insistence on standard vocabularies. For getting data out of source systems, interfaces based on the HL7 FHIR standard increasingly supplement traditional message feeds and database extracts (Mandel et al., 2016).

Deciding whether two records refer to the same person is the oldest problem in health data integration. The probabilistic theory of Fellegi and Sunter (1969) compares pairs of records field by field, weights each agreement or disagreement by how much more likely it is among true matches than among non-matches, and classifies pairs as links, non-links or possible links for manual review. Modern practice adds blocking to limit the number of comparisons, approximate string comparison for names, and systematic evaluation of linkage quality (Christen, 2012). Where identifiers may not be exchanged in clear text, linkage can be performed on encoded values (Schnell et al., 2009).

Data quality is a matter of fitness for the consumer's purpose and has several dimensions beyond accuracy (Wang and Strong, 1996). For electronic health records, Weiskopf and Weng (2013) identified completeness, correctness, concordance, plausibility and currency as the dimensions assessed in the literature. The cleaning problems met during integration, such as conflicting values, differing representations and duplicates, were classified by Rahm and Do (2000). Privacy law frames everything. In the United States the HIPAA Privacy Rule governs the use and disclosure of protected health information and defines routes to de-identification (US Department of Health and Human Services, 2002). In the European Union the General Data Protection Regulation treats health data as a special category (European Parliament and Council, 2016).

Technical work should not begin until the member organisations have agreed in writing what the warehouse is for, who is accountable for it and under what legal basis each source will contribute. A steering group with clinical, information governance and technical members should own those decisions. The team then catalogues every candidate source: the system, its custodian, the tables or messages available, the identifiers used, the code systems, the period covered and the extraction route. The catalogue usually reveals that several sources hold overlapping versions of the same facts, and one must be named as authoritative for each.

A dimensional warehouse is organised around processes that generate measurable events. For a hospital network a reasonable first set is inpatient and outpatient encounters, diagnoses, procedures, laboratory results and medication orders. For each the team writes one sentence stating the grain, for example one row per diagnosis recorded against an encounter, or one row per reported result of a single laboratory test. A bus matrix, with processes as rows and dimensions as columns, records which dimensions each fact table uses and exposes where conformity will be needed. Starting with encounters is advisable, since most other facts hang from an encounter.

Patient, provider, facility and date dimensions are shared by nearly every fact table and must be built once. Each receives a surrogate key generated by the warehouse, so that source identifiers can change without breaking history. Coded clinical concepts need the most care. The network should choose a target code system for each domain, such as the International Classification of Diseases for diagnoses and LOINC for laboratory tests, and maintain explicit maps from every local code to the target. The local code is kept beside the mapped one in the dimension, so that an analyst can always see what was originally recorded and a mapping error can be traced.

This step decides whether the warehouse can answer network-wide questions at all. Records from each site's patient index are standardised, with names parsed, dates validated and addresses normalised, and are then compared within blocks defined by fields such as date of birth or a phonetic name code. Pairs are scored in the Fellegi-Sunter manner. Two thresholds divide them into automatic links, automatic non-links and a middle band for clerical review. The thresholds reflect a judgement about which error is worse: a false link merges two people's histories, while a missed link merely leaves a history split. For analytical use a conservative upper threshold is the safer default. The result is a master patient index that maps every source identifier to one warehouse patient key, with the match score and method retained for audit.

Extracts land unchanged in a staging area, where they are profiled, cleaned and mapped before any warehouse table is touched; the design choices available for such pipelines are surveyed by Vassiliadis (2009). Three behaviours should be specified in advance. Dimension attributes that change, such as a patient's address or a provider's department, are handled as slowly changing dimensions, with a new row and validity dates when history matters for analysis. Corrections issued by a source replace the earlier fact while an audit column records the load in which each version arrived. Facts that arrive before their dimension member, a laboratory result for a patient not yet registered in the index for instance, are attached to a placeholder member and repaired on a later load.

Each load is tested against a catalogue of rules before it is released. The dimensions of Weiskopf and Weng (2013) give the catalogue its structure. Completeness rules check that expected fields and expected volumes are present for every site and period. Plausibility rules check ranges and sequences, such as a discharge that precedes its admission. Concordance rules compare related elements, such as a procedure against the patient's recorded sex where that is clinically determinate. Currency rules check the delay between an event and its arrival. Failures are reported to the source custodian for correction at origin, because a fix applied only in the warehouse will be undone by the next extract.

Access is granted by role. Staff engaged in direct care or operational management may need identified data for their own facility; analysts generally do not. For them the warehouse should present views in which direct identifiers are removed and dates and geography are coarsened. The HIPAA Privacy Rule offers two routes to de-identification, expert determination and the removal of eighteen listed types of identifier, and the second is the simpler to implement as a view. Removal of identifiers does not by itself prevent re-identification from combinations of ordinary attributes, the risk that the k-anonymity model was devised to measure (Sweeney, 2002), so small cells in released aggregates should be suppressed. Every query against identified data is logged.