We had biostatisticians on staff as well as third party companies review our de-idenitification regularly. From a population level we were quite solid. That s

We had biostatisticians on staff as well as third party companies review our de-idenitification regularly. From a population level we were quite solid. That said, were I an attacker trying to re-identify a specific person's data it would be hard to do with just basic demographic information but if you combine some specific health knowledge (a couple health problems you know your coworker has) or appointment info (date, type of doctor, stuff that may also come up in common conversations) it gets a lot easier.