When I was involved with some people who wanted to do this, they had a security expert on the "board" who would bring up that study where given 2 (or 3?) pieces of information about a person, you can ID them. I guess just knowing the hospital and the sample and the date, you could ID the person.
Anyway, these were the kinds of discussions I had for a year and then decided to leave the world of semi-academic meta-bio research because there were too many "committees" and "boardS" and "experts" and nothing ever got done.
Oh right, Information Theory. There was a cool article on HN about that a while back, showing you only need something like 3 bits (zip code, birth date, and something else iirc) to identify anyone in the world.
Anyway, these were the kinds of discussions I had for a year and then decided to leave the world of semi-academic meta-bio research because there were too many "committees" and "boardS" and "experts" and nothing ever got done.