I spent a good deal of my professional life in the last decade dealing with the problem of de-identifying medical data. You are correct that it's hard, but th

I spent a good deal of my professional life in the last decade dealing with the problem of de-identifying medical data. You are correct that it's hard, but the HIPAA rule is actually not a bad go at it. See https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html https://www.hhs.gov/hipaa/for-professionals/privacy/special-.... For the kind of data in this particular database (mostly insurance claims data), it's highly unlikely that you could learn much through re-identification of the data.