[prepend]

Aggregate counts are not private healthcare information when released in a way that limits reidentification. The Privacy Act (and HIPAA) allows for deidentified data to be shared broadly.

Anyway, prisoner gender is not healthcare data, it’s administrative data that describes prisoner population demographics.

I would agree with you if the request was for individual medical information on treatment or procedures or something.

[joshuamorton]

> Aggregate counts are not private healthcare information when released in a way that limits reidentification. The Privacy Act (and HIPAA) allows for deidentified data to be shared broadly.

Possibly, but you're almost assuredly looking at a sample of N=10 or fewer, so the answer would be "*" anyway.

[prepend]

Not if it’s just a count. Because, even with a low count it wouldn’t be used to identify someone.

Let’s say there were 3 transgender people in the state, or even a facility. If they reveal that number it doesn’t identify an individual or divulge any confidential information.

The low counts have to be suppressed when coupled with other data or linked to other data.

If you included count by age group, then you would need to change from a low count to a suppressed marker.

For example 3 transgenders in the 80+ age group might reveal their identity because there aren’t many 80+ inmates.

But just having a small count with no other info is not really a cause to remove the value.