Fable
The prescription book no one could claim
A medical clinic in the city wanted to hand years of patient records to students for research. The director first ordered names to be scraped off and replaced with A, B, C, D. Everyone thought this made it safe; the patient's face had disappeared from the paper. The director originally wanted to do a good thing: let students see more cases and make fewer misdiagnoses in the future. Precisely because the purpose was legitimate, people were more likely to underestimate the risk of the pages pointing back to a person.
Soon, a student compared the medical case with the roster outside the city: 'sixty-two years old, lives at South Bridge, broke his right leg at the winter solstice, runs a dye workshop'—only one person in the whole city matched. The name was gone, but the person had been found again. The clinic had for the first time handled only the conspicuous name, and had also deleted the house number. But the student pieced together age, occupation, time of the accident, and neighborhood rumors, and still identified the person.
Only then did the curator discover that secrets were hidden not only in names, but also in rare combinations. In their second pass, they changed ages into age brackets, merged streets and alleys into districts, and grouped rare diseases into broad categories; records that were too rare were temporarily not lent out.
Students complained that the materials had become too coarse and many details were unusable. The curator did not deny it: the harder it is to trace back to an individual, the lower the sharpness available for research tends to be. So the clinic divided the volumes by purpose—coarse volumes for ordinary teaching, fine volumes for strictly controlled research, with access requiring registration and no removal. The second version cut too aggressively, and students could no longer see the progression of the illness. The curator then graded by question: coarse granularity for teaching, details in a small room for strictly controlled research, and even blurrier material for external use.
The clinic also invited outsiders to try to re-identify. If an outsider guessed back to a certain patient from a few clues, the material was sent back for rework. Security is not about feeling that you yourself can't see through it, but about others also finding it hard to piece back together.
The curator also explained the trade-offs to the students. The finer the data, the closer to real patients, and the easier to cause harm; the coarser the data, the fewer research questions there would be. Every external loan required first asking the purpose, then deciding what granularity to retain.
What is handed over in the end is not a case file with fake names, but a set of materials whose personal identifiers have been weakened. Redaction is only the beginning; the real challenge is preventing others from piecing the person back together using the surrounding clues.