A healthcare organization wants to share de-identified patient data with a research university.Under HIPAA, de-identification requires: