Why small numbers are dangerous: small-cell suppression in health statistics

Open almost any public health report — cancer incidence by county, hospitalizations by ZIP code, overdose deaths by age band — and somewhere in the tables you will find an asterisk where a number should be. The footnote says something like counts under five suppressed. In a metropolitan county the asterisk is a formality. In a county of four thousand people, where the church, the diner, and the school parking lot function as a social network with full coverage, that asterisk may be the only thing standing between a published statistic and a neighbor's diagnosis.

The asterisk is one of the oldest privacy technologies in public health. It is worth understanding properly, because the idea behind it now runs far beyond printed tables.

The rule that hides small numbers

Small-cell suppression is the practice of withholding any published count that describes fewer than a threshold number of people — typically 5, 10, or 11 depending on the steward.

The danger it manages is concrete. A count of one or two, sitting at the intersection of a geography column and a condition row, is not a statistic; it is a description of a person wearing a thin disguise. Whoever already knows a little — that a coworker was out sick for months, that a teenager in town was hospitalized — can complete the identification with the table's help. The attacker the rule defends against is not a hacker with a supercomputer. It is anyone with local knowledge, which is everyone.

Formal research caught up with the practice later. Latanya Sweeney's estimate that 87% of Americans are unique on ZIP code, birth date, and sex put numbers on what table publishers had long intuited: small groups identify people, and the smaller the geography, the smaller the group. The same mechanism drives every famous unmasking of "anonymous" data — we walk through those cases in re-identification attacks.

Where the thresholds come from

The thresholds come from decades of statistical-agency practice, converging — without ever fully agreeing — on single digits and low double digits.

AHRQ, which stewards some of the most widely used hospital datasets in the United States, builds the restriction into its data-use terms rather than leaving it to publisher judgment — a detail that matters more than the number itself. The same philosophy shows up in HIPAA's de-identification guidance, which treats small populations and rare characteristics as residual risks even after formal de-identification.

Why no single canonical threshold? Because the line is a trade. Lower thresholds publish more; higher thresholds protect more; smaller geographies and rarer conditions push the safe line upward. The honest summary is that the exact value is a judgment call and the existence of an enforced value is not. Five protects more than four does, ten more than five — and zero, which is what no rule means, protects no one.

One hidden cell is not enough

If totals are published, a single suppressed cell can be recovered by subtraction — so the rule's lesser-known half, complementary suppression, hides additional cells to block the arithmetic.

The failure is embarrassingly simple. A row reads: total 100, clinic A 60, clinic B 37, clinic C suppressed. Any reader with subtraction recovers the asterisk: three. To actually protect clinic C's three patients, the publisher must also suppress a companion cell — say clinic B — so the remainder is ambiguous. Done across a real publication, this cascades: suppressions in one table imply suppressions in others that share margins, and the bookkeeping becomes genuinely adversarial. Statistical agencies employ specialists and software for exactly this problem.

Two things follow. First, suppression is harder than it looks, which is why "we hid the small numbers" is not by itself a privacy claim. Second, the difficulty compounds when the publication is not one frozen table but an endless stream of them — which is precisely what a modern data platform is.

From frozen tables to living cohorts

A research platform is a machine that generates new tables on demand, so the suppression rule has to move from the publication step into the query path. That migration has a name: a k-anonymity floor.

A table cell with n below five and a query cohort with k below five are the same object — a group too small to hide in. The difference is operational. A printed table is reviewed once by a human who applies the rule; a query engine answers questions nobody anticipated, at all hours, forever. The only version of the rule that survives that environment is one enforced inside the engine itself: every result, every cohort, every aggregate must describe at least k people or it does not come back. The full logic of group-size protection — what it guarantees and where it stops — is laid out in k-anonymity, explained, and the question of what makes a group a cohort in the first place has its own machinery.

The differencing problem migrates too: two large query results can subtract to a small one, just like table margins. Query gating and disclosure audit address it structurally, and for public-facing statistics, differential privacy extends the instinct with formal noise. But the floor remains the load-bearing wall. Noise makes small numbers fuzzy; the floor refuses to discuss them at all.

A line that doesn't move under pressure

The way suppression rules actually fail is not mathematical. It is organizational: the rule lives in a policy document, an important study arrives, and someone senior decides that this once the threshold can flex. Every threshold that can be waived eventually is.

This is why Mithras Health implements the line as apparatus rather than policy. Research queries on the platform return aggregates only, and every result must clear a hard k ≥ 5 floor — a cohort below five people cannot be released, for any study or any requester, and the threshold is not configurable. When the gate refuses, the refusal is written to an append-only audit trail, so the rule's enforcement history is itself inspectable. It is the health department's asterisk, rebuilt for a world where the tables generate themselves.

An asterisk in a printed table is a small act of restraint by a careful statistician. A floor in a query engine is the same restraint kept automatically — at three in the morning, for the ten-thousandth query, against questions no one had imagined when the rule was written. Public health learned long ago that small numbers are where privacy goes to die. The engineering task is just to make sure the lesson holds without anyone having to remember it.