Good question. I usually see highly upvoted articles about the evils of widespread data collection but apparently it's totally fine to publish confidential medical information on the news and make examples out of patients.

When they change names, they usually write something like:

> Some names and identifying details have been changed to protect the privacy of individuals.

The author did not write that. I don't see any evidence the patient consented to have his case published either.

Even disregarding the name, there's almost certainly enough info to identify the person here.

The combination of homelessness, first name, age, insurer, rough location, and a laundry list of major diseases is absolutely PII.

https://dataprivacylab.org/projects/identifiability/paper1.p...

> It was found that 87% (216 million of 248 million) of the population in the United States had reported characteristics that likely made them unique based only on {5-digit ZIP, gender, date of birth}. About half of the U.S. population (132 million of 248 million or 53%) are likely to be uniquely identified by only {place, gender, date of birth}, where place is basically the city, town, or municipality in which the person resides. And even at the county level, {county, gender, date of birth} are likely to uniquely identify 18% of the U.S. population. In general, few characteristics are needed to uniquely identify a person.

How many 54-year-old Steves exist? How many of those have multiple sclerosis, cerebral palsy, heart disease, and diabetes at the same time? How many were homeless?

I've seen people identify patients using far less information than that. It's a small world.