How does de-identification protect privacy in public health data, and what is a potential risk?

• A. Only anonymizes names but leaves all other data intact.
• B. No risk if data are published.
• C. Removes or masks identifiers to prevent re-identification; risk remains with highly detailed or small subgroups that could still identify individuals.
• D. Prevents any possibility of re-identification in all cases.

Answer: (C)

De-identification protects privacy by removing or masking identifiers so a person cannot be readily identified from the released data. This typically means taking out direct identifiers like names and addresses and also generalizing or suppressing quasi-identifiers such as specific ages, locations, or dates. The goal is to prevent someone from linking a dataset to a particular individual, reducing the risk of re-identification when data are shared or published.

However, a potential risk remains: if the data are very detailed or include small subgroups, rare conditions, or unique combinations of attributes, someone with additional information could still piece together who the record belongs to. So re-identification isn’t impossible in all cases, and the risk depends on how granular the data are and what external data are available for linkage.

The other options don’t fit because de-identification typically goes beyond just anonymizing names, publishing data can still pose re-identification risks, and no method can guarantee zero re-identification risk in every scenario.