A hospital plans a public table of rare diagnoses broken out by postal code and age in years, and several cells would contain a single patient. What should that release do?
Select an answer to reveal the explanation.
Short Explanation
A rare diagnosis plus a tight postal code and an age can point at one person the way a small-town rumor does. You aggregate or anonymize before a public release so nobody can be singled out. Publishing the one-patient cells, or swapping codes you can undo, leaves that path open.
Full Explanation
A public cell that holds one patient, defined by a rare diagnosis, a postal code, and an age, can single that person out even when the name column is absent. The release should aggregate categories, suppress or combine small cells, or otherwise anonymize so that combination no longer points at one person. Publishing the one-patient cells because no name is printed misses how quasi-identifiers work: the diagnosis plus the details can be enough. A reversible swap of postal codes, published with the method that undoes it, is obfuscation a reader can reverse, not a removal of the singling-out path. Rounding ages to the nearest year does nothing when the ages are already in whole years, and it leaves the one-patient cells in the public table. Exam caveat: aggregation has to be coarse enough that the published cells are no longer single people; a cosmetic relabel that preserves those cells does not meet the goal. Operational check: count the patients behind each public cell of diagnosis, postal code, and age, and hold the table until no released cell singles a person out.