That's one option: you combine protected, de-identified information with unprotected (e.g. non-health) information to re-identify the protected information. But

That's one option: you combine protected, de-identified information with unprotected (e.g. non-health) information to re-identify the protected information. But also, something like Facebook allows you to target a person who lives in $TOWN, works at $COMPANY, born in $YEAR, even if you don't know that person's name or SSN.