Open Dashboard, Small ZIP Counts, Rare Condition
A regional clinic wants to publish an open dashboard showing chronic-condition prevalence by ZIP code and age band. The dataset has 4,800 patients. One rural ZIP has 1,900 residents but only 14 clinic patients; 3 of them have a rare condition. Another ZIP has 620 clinic patients. The dashboard would include exact counts and a filter for age band 18-24 and condition, and would be public and downloadable with the clinic's name on it. The communications lead argues that ZIP-level data is already public and patients consented to treatment, so exact counts are fine. The clinic also wants to use the dashboard for outreach planning and to show funders that the program reaches rural areas. Your manager asks you to review before publication.
1. Identify the disclosure risks in the proposed dashboard beyond removing names.
Read the worked answer
Removing names is not enough because the risk comes from combinations and small counts. A rural ZIP with 14 clinic patients and 3 cases of a rare condition creates a small cell; adding age band 18-24 and a condition filter can make a cell of 1, which is effectively an identifier in a small community. A public downloadable file allows linkage with voter rolls, school lists, local news, or prior knowledge to infer who the patients are. The 'mosaic effect' matters: ZIP plus age plus condition plus clinic name may be more identifying than any single field. Consent to treatment is not consent to public re-identification, and a rare stigmatized condition raises harm beyond legal compliance. The outreach use case is legitimate, but it does not require exact small-area counts to be public.
2. Propose specific disclosure-control rules and explain the tradeoff with the outreach use case.
Read the worked answer
I would set a minimum cell size of 10 or 11 for any published count, suppress cells below that threshold, and apply complementary suppression so a suppressed cell cannot be recovered by subtracting published totals. I would collapse age bands, report rates with denominators or ranges rather than exact numerators for rare conditions, and publish rare-condition data only at county or regional level, not ZIP. For public release, I would remove the download of record-level data and consider rounding counts. For outreach, the clinic can keep a restricted internal version with small-area detail under access controls and a data-use agreement. The tradeoff is real: public suppression reduces hyperlocal precision, but the internal version preserves planning use. Publishing a coarser public layer satisfies the funder's rural-reach story without exposing three identifiable patients.
3. How would you respond to the communications lead who wants exact counts?
Read the worked answer
I would acknowledge the valid points: ZIP codes are public, and the clinic has a legitimate interest in transparency and outreach. Then I would separate public geography from patient-level combinations: a public ZIP does not make a count of 3 rare-condition patients in a 14-patient ZIP safe, and consent to treatment is not consent to publication. I would offer alternatives that meet the communications goal: show rural reach with aggregated county-level rates, use ranges or percentages with a minimum denominator, and keep exact small-area counts in a restricted internal dashboard. I would document the decision and the rationale, and ask the communications lead to review the suppressed public mockup before launch. This frames the issue as meeting the goal safely, not as blocking the project.