One troubling re-identification attack for medical data is the trail re-identification method [0]. A lot of privacy analysis will consider the data to be in the

One troubling re-identification attack for medical data is the trail re-identification method [0]. A lot of privacy analysis will consider the data to be in the shape of a table T with some columns A,B,C and use the notation T<A,B,C> to describe a de-identified dataset. The trail method will take multiple de-identified datasets, each from a different hospital, T_1<A,B,C> T_2<B,C,D>, T_3<C,D,E> and use their shared columns to narrow down on a set of individuals. So, even though each hospital may have a legitimately de-identified dataset in isolation, it is not de-identified when combined with the (also de-identified) data from another hospital. The risk of this attack increases as patients visit more hospitals. We humans are fairly long-lived and tend to move around so it may be substantial. (That being said some hospital systems are quite large like Kaiser Permanente and serve huge areas so visiting multiple hospitals doesn't necessarily create multiple tables.) [0] https://dataprivacylab.org/dataprivacy/projects/trails/trails2.html https://dataprivacylab.org/dataprivacy/projects/trails/trail...