Mapping “Patient b15-2gty” back to your real name has been trivial for decades.

My first job involved a one hour lecture about how people had repeatedly accidentally deanonymized and accidentally leaked data at other institutions, leading to divorces and worse.

We had somewhere between 10 to 100 bytes of entropy on each patient, and it would have been enough for any of their acquaintances to map back to real names and also severely violate privacy.