Age. Its like if a rare disease enters the hospital, you have to deidentify all data because if there's only one person with say, a rare infection, and only one person who received a treating medication, there can be a correlation. Her problem will be the identification of age, which would likely allow others working at the institution who should not have access to identify the patient. My guess is she still has a good case, but it's not open and shut. You'd be surprised how many clinicians say they understand privacy laws and then send an email with PHI the next day.