I work in healthcare (though not with any efforts like those described in the article). Anonymizing data is much more complicated than simply removing the obvio

I work in healthcare (though not with any efforts like those described in the article). Anonymizing data is much more complicated than simply removing the obvious PII: depending on what the data is, even things like procedure codes with dates might be enough to identify a patient. HIPAA and other related regs account for this, and have pretty strict procedures that must be followed before data can be considered officially deidentified.