[cheeseprocedure]

A recent Canadian example:

> The data being broadcast includes the patients name, age, gender marker, diagnosis, their attending doctor and room number. Other broadcasts regarding medical tests such as x-rays are often associated with a patients last name or medical number, exposing their progression through hospital departments.

https://openprivacy.ca/blog/2019/09/09/open-privacy-discover...

[Scoundreller]

So don't include information that isn't necessary. rm name/age/gender.

If it's the organization's in-house medical number, that should be okay. It's literally a random identifier number. Or better yet, use a visit number, test number or result number to avoid linking them together.