it has been repeatedly shown that deanonymized healthcare data is not hard to reconstruct. HIPAA defines a series of identifiers that have to be scrubbed, but it's not enough to prevent reidentification by a motivated adversary.