Abstract: Apparatus and method for creating de-identified and linked records is described. More particularly, data records are de-identified at a client computer. De-identification includes field-level one-way encryption. De-identified records may then be sent to a server computer for linkage. Linkage is done using match codes created for such data records at the client computer. The server computer is configured to provide longitudinal linkage of de-identified client records to de-identified master records. In this manner, privacy may be maintained at the client computer prior to transmission of information, and longitudinal linkage of records may occur without exposing personally identifying information.