The increasing use of electronic health record data for secondary purposes has become a cornerstone of clinical research, health services planning, and AI development in medicine [1]. This progress creates an inherent tension. Patient privacy must be safeguarded, while data quality must remain sufficient for valid statistical inference. The European General Data Protection Regulation [2] codifies strict obligations for processing personal health information. Under the General Data Protection Regulation, anonymization may allow broader data sharing where the applied transformations make reidentification sufficiently unlikely in the relevant context.

Among the most widely adopted paradigms, k-anonymity, proposed by Sweeney [3], guarantees that each combination of quasi-identifying attributes appears in at least k records. The ARX Data Anonymization Tool, developed by Prasser et al [4], implements k-anonymity alongside l-diversity [5], t-closeness [6], and differential privacy [7] within a unified open-source framework. ARX applies generalization hierarchies, record suppression, and microaggregation to achieve privacy guarantees while optimizing utility through configurable loss functions [8]. Its application spans clinical trial data sharing [9], pandemic cohort publication [10], and multisite registry studies [11]. Its broad acceptance in the research community is precisely what makes it a suitable target tool for a methodological case study, because findings obtained with ARX are relevant to a large body of existing and future work.

Despite the maturity of anonymization algorithms, systematic evaluation of downstream statistical consequences remains underdeveloped. Five principal approaches currently inform quality assessment. Information loss metrics embedded within tools capture transformation cost but not external analytical validity [4]. Descriptive concordance methods compare summary statistics, with Ohno-Machado et al [12] showing that suppression preserves means while degrading prediction. CI overlap approaches, as demonstrated by Pilgram et al [13], evaluate analytical agreement under use-case–specific configurations. Distributional divergence methods use statistical tests, applied for instance by Jakob et al [10] to COVID-19 anonymization pipelines. Regression reproducibility frameworks, as used by Johann et al [14], test whether clinical associations survive transformation. Recent work continues to confirm that privacy-enhancing transformations degrade analytical utility in ways that depend on the downstream task. Cohen et al [15] quantified the effects of pseudonymization on 6 archetypal epidemiological analyses in a clinical data warehouse and showed that achieving low reidentification risk required modifications that compromised the reliability of specific statistics, and Kaabachi et al [16] cataloged in a scoping review the heterogeneous privacy and utility metrics used across medical studies and the difficulty of identifying an optimal balance.

Each of these approaches illuminates one facet of the privacy-utility trade-off. However, their isolation limits explanatory power. Distributional fidelity metrics quantify what changed in the data structure but cannot determine whether those changes compromise downstream conclusions. Inferential reproducibility tests reveal whether conclusions changed but, without distributional context, cannot explain why or through which transformation mechanism. Combining both dimensions within a single evaluation approach can address this interpretive gap. Distortion patterns such as variance compression or vocabulary erosion, once identified through distributional analysis, can be directly linked to concordance or divergence in the statistical estimates derived from the transformed data. This gap is particularly relevant when anonymization relies on record suppression combined with microaggregation, a configuration that arises whenever generalization hierarchies cannot be specified for all quasi-identifiers. Numeric attributes such as hospital length of stay (LOS) lack a natural semantic hierarchy [17], compelling tools such as ARX to apply microaggregation instead [8]. The analytical consequences of this specific combination remain largely unquantified, as existing evaluations have focused predominantly on generalization-based pipelines [13].

Against this methodological backdrop, 2 clinical data elements occupy a uniquely central position in hospital research. These are the primary diagnosis coded in the International Classification of Diseases (ICD) system and the hospital LOS. Primary ICD codes define case classification for diagnosis-related group reimbursement [18], serve as epidemiological cohort criteria, and anchor outcome research. The LOS functions as a proxy for disease severity, resource consumption, and care efficiency [19]. The association between diagnosis and LOS has been extensively investigated [20-29]. Any anonymization-induced distortion of these attributes may directly threaten the validity of downstream analyses. Given this context, 3 research questions (RQs) guided this investigation.

The 3 RQs are as follows:

This methodological case study combines distributional impact assessment with inferential reproducibility testing on a large-scale hospital encounter dataset. The intent is not to model a comprehensive real-world data release, but to demonstrate, using a widely adopted anonymization tool under self-configured anonymity, transformation, and utility parameters, that meaningful distributional and inferential distortions can occur which the tool itself does not report. The analysis proceeds in 4 phases: cohort extraction and characterization, anonymization at 3 k-anonymity thresholds using ARX, distributional distortion quantification through a purpose-built comparison framework, and inferential reproducibility evaluation by fitting identical linear mixed model (LMM) specifications to original and anonymized data.

This study received approval from Ethics Committee II, Medical Faculty Mannheim, Heidelberg University (ID: 2024‐885). A data protection impact assessment was positively evaluated. The local Use and Access Committee granted formal approval. All analytical datasets were processed and handled in deidentified form within the approved institutional governance framework.

For this evaluation, hospital encounter data were extracted from the clinical data warehouse of the Medical Data Integration Center at University Hospital Mannheim (Universitätsmedizin Mannheim). The query targeted inpatient encounters of the study period. For the present analysis, the cohort was rederived directly from recorded admission and discharge dates, retaining only encounters whose admission date and discharge date both fell within January 1, 2010, and September 30, 2024 (revised data preparation in Multimedia Appendix 1). The resulting dataset comprised 5 data elements per encounter: a pseudonymous patient identifier, a unique encounter identifier, the admission year, the primary ICD-10-GM diagnosis code, and the LOS. LOS was computed as the difference in days between discharge and admission, with same-day encounters assigned a value of 1. Because the cohort was defined on the basis of present and valid admission and discharge dates, no encounter had a missing LOS value, and no encounter was excluded for that reason.

Anonymization was performed using the ARX Data Anonymization Tool (version 3.9.2) [4]. Three separate configurations were applied to the same source dataset (N=719,387 encounters), producing anonymized variants at k=5, k=10, and k=15. Secure Hash Algorithm 256-bit checksums verified each output. Table 1 details the complete ARX configuration. Two quasi-identifiers were designated: the primary ICD diagnosis code (categorical) and LOS in days (integer). The patient identifier and admission year were retained outside the quasi-identifier set, the former to enable patient-level random effects and the latter to enable a temporal sensitivity analysis, and neither was anonymized. These 2 variables were not intended for external release.

Two configuration choices warrant explicit justification because they directly governed the suppression behavior and the resulting distortion. First, no generalization hierarchy was applied to ICD codes, which were treated as a flat categorical attribute by setting the hierarchy height to 1 with minimum equal to maximum equal to 0 [4,8]. This was deliberate. RQ1 measures how anonymization alters the full ICD code distribution at the level at which codes are originally recorded, and RQ2 evaluates whether diagnosis-associated LOS differences remain reproducible at the 3-character level after the transformation. Pregeneralization would have collapsed full codes (eg, E11.40, E11.41, and E11.49) into their parent category (E11) before anonymization, eliminating the variability that the suppression mechanism is intended to act upon. Suppression would then operate on an already-coarsened code set, and the comparison between original and anonymized data would reflect the combined impact of precoarsening and anonymization rather than the impact of the anonymization step itself. Treating each full code as an indivisible unit ensured that suppression remained the only mechanism acting on the categorical structure.

Second, the suppression limit was set to its maximum admissible value of 0.50, equal optimization weights of 0.50 were assigned to both quasi-identifiers, and information loss was aggregated using the geometric mean. The equal weighting reflects the absence of an a priori reason to privilege either the categorical or the numeric quasi-identifier, and it allows suppression and microaggregation to act with comparable intensity on both attributes rather than concentrating distortion on one of them [4,8]. The geometric mean is the aggregation function used by ARX to combine the normalized per-attribute information losses into a single utility score, and it penalizes uneven loss across attributes more strongly than an arithmetic mean would, which is appropriate when no single attribute should be sacrificed to preserve another [8,17]. The permissive suppression limit was chosen specifically to test whether a high admissible suppression budget would translate into aggressive data deletion. The optimization function was active throughout, and the result is informative in itself. Despite a 50% admissible suppression budget, the optimizer satisfied k-anonymity by masking fewer than 1% of encounters at k=5 and fewer than 3% at k=15 (Multimedia Appendices 2-4), which shows that the observed distortion is not an artifact of brute-force deletion under a loose limit but a structural property of the suppression-plus-microaggregation configuration. The search strategy was the deterministic optimal solution, so the search space contained exactly one transformation per k level; because the ICD hierarchy height was fixed at 1 and no other generalization degrees of freedom existed, there were no alternative thresholds for the tool to optimize across, and reporting a single deterministic solution removes a source of run-to-run variability from the comparison.

However, the equivalence classes that failed to reach the k threshold were resolved exclusively through suppression. In ARX, suppression of this kind does not delete records [30]. The tool replaces the affected quasi-identifier values with a missing token and continues to count and aggregate over the dataset until the k threshold is satisfied. For each encounter that could not be placed in a sufficiently large equivalence class, the primary ICD and the LOS were masked jointly, which confirms record-level rather than independent per-attribute masking. For LOS, microaggregation grouped records into clusters and replaced individual values with the cluster centroid. The geometric mean was used as the microaggregation function so that the imputed centroid is consistent with the logarithmic scale on which the length-of-stay outcome is subsequently modeled. For the strictly positive length-of-stay values in this cohort, the geometric mean equals the exponential of the mean of the log-transformed values, which may reduce the positive bias that arithmetic-mean substitution would introduce under a concave transformation. ARX preserves the original data type of the microaggregated attribute, so the geometric-mean centroids were returned as integer-valued length-of-stay days consistent with the discrete scale of the input variable rather than as continuous floating-point values, and all subsequent statistical tests and model fits were performed on this integer-preserving output.

In this study, LOS serves a dual role. It is designated as a quasi-identifier subject to microaggregation by ARX, and it is simultaneously the response variable in the inferential reproducibility analysis (RQ2). This configuration is a deliberate worst-case evaluation design and is central to the aim of the study. Because microaggregation directly transforms the outcome variable, any observed inferential degradation represents an upper bound on the distortion that would occur when the analytical target is not itself part of the quasi-identifier set. We retained this design intentionally, because the purpose of the study is methodological. We use ICD code and LOS to demonstrate that distributional and inferential distortions can occur under self-configured anonymity and utility settings without the anonymization tool reporting them and to argue that effect-assessment findings of the kind reported here should accompany any analysis performed on anonymized data elements. Introducing an additional clinical outcome that is independent of the quasi-identifier set would weaken the worst-case demonstration and is not necessary for this objective, because the contribution of the study is the transparent quantification and reporting of the transformation footprint, not a substantive clinical claim about LOS. Analysts should interpret the inferential results accordingly. Studies in which the analytical outcome variable is not subject to anonymization transformation may experience substantially less inferential disruption than reported here, and the magnitude reported here should therefore be read as a ceiling.

The selection of exactly 2 quasi-identifiers is likewise a deliberate mechanism-focused design rather than an attempt to model a comprehensive real-world data release. ICD codes and LOS represent the 2 most frequent clinical data types requiring anonymization in hospital settings, namely, a high-dimensional categorical field and a right-skewed numerical outcome. Comparable variable pairings have been examined by Ohno-Machado et al [12], who evaluated suppression effects on diagnostic codes and outcomes; by Pilgram et al [13], who assessed anonymization costs using diagnosis and laboratory data; and by Johann et al [14], who quantified utility loss for clinical scoring variables. By restricting the quasi-identifier set to these 2 elements, the study isolates the interplay between suppression and microaggregation while reducing additional sources of distortion from broader anonymization settings. Variables such as age, sex, and admission date were available in the source warehouse but intentionally excluded, because their inclusion would confound mechanism-specific effects with additional generalization or suppression pathways outside the scope of the RQs. The consequence for external validity is addressed explicitly in the Limitations and Future Work section.

A purpose-built R function, quantify_anonymization_impact(), was developed to systematically compare original and anonymized datasets [31]. The function accepts 2 data frames and optionally 2 column vectors for targeted ad-hoc comparison.

Inferential reproducibility was operationalized as the degree to which the diagnosis-level signal recovered from anonymized data agrees with the signal recovered from the original data, assessed across 5 complementary quantities that separate variance structure, rank agreement, and magnitude agreement. First, the ICC=σ2_icd3/(σ2_icd3+σ2_patient+σ2_residual) quantifies the proportion of total log-LOS variance attributable to diagnosis-group membership [48], and the Nakagawa-Schielzeth R² provides a complementary variance decomposition [49]. Second, rank agreement of the diagnosis-level BLUPs between the original and each anonymized model is assessed with the Spearman rank correlation ρ_S [50], which answers whether diagnoses keep their relative position in the LOS hierarchy. Third, magnitude agreement is assessed with the Lin concordance correlation coefficient (CCC) [51], which evaluates rank preservation and magnitude agreement simultaneously by measuring how closely paired BLUP estimates fall on the identity line, and which decomposes into a precision component (Pearson r) and an accuracy component (bias-correction factor Cb) [51], with interpretive strength-of-agreement bands proposed by McBride [52]. Reporting both ρ_S and CCC follows the principle that a rank correlation can remain high even when absolute magnitudes diverge [53]. Fourth, the fraction of ICD-3 categories whose BLUP changes sign between the original and anonymized model is reported, since a sign reversal indicates a qualitative reinterpretation of the diagnosis-to-LOS relationship, and the median absolute deviation of BLUP pairs provides a magnitude-focused dispersion measure that is resistant to outliers. Fifth, model fit and prediction accuracy are tracked through AIC, Bayesian information criterion, log-likelihood, root mean square error (RMSE), and mean absolute error. To quantify the precision of the 2 agreement statistics, 95% CIs were computed for the Spearman correlation and for the Lin CCC. All analyses were conducted in R (version 4.4.0; R Foundation for Statistical Computing).

The cohort extraction yielded 719,387 inpatient encounters belonging to 370,548 distinct patients, spanning January 2010 through September 2024. LOS ranged from 1 to 557 days, with a mean of 6.52 (SD 9.74) days, and a median of 4 (IQR 2-7) days. Because the cohort was restricted to encounters with valid admission and discharge dates, every encounter had a defined LOS, and no encounter was excluded for missing LOS. The 5 most prevalent primary ICD-10-GM codes were Z38.0 (single live birth, 2.4%), G47.31 (obstructive sleep apnea), C61 (prostate carcinoma), S06.0 (concussion), and I63.4 (cerebral infarction). No single diagnosis exceeded 3%, confirming a diffuse diagnostic landscape typical of tertiary university hospitals. The original dataset contained 7715 distinct full ICD-10-GM codes, mapping to 1404 unique 3-character prefix categories (ICD-3), which served as the diagnosis grouping variable for all mixed-model analyses.

ARX satisfied the anonymity criterion at every level with a deterministic search space of size 1 (Multimedia Appendices 2-4) and reported internal information-loss values (geometric mean) of 0.074 at k=5, 0.084 at k=10, and 0.093 at k=15. Consistent with the mechanism described in the Methods section, ARX did not delete any encounters. The number of rows was identical across the original and all 3 anonymized datasets, and the privacy guarantee was achieved by masking quasi-identifier cells with a missing token (data_point_removal.csv in Multimedia Appendix 5). The proportion of encounters carrying at least 1 masked quasi-identifier cell rose from 0.77% at k=5 (5564 encounters) to 1.71% at k=10 (12,315 encounters) and 2.62% at k=15 (18,858 encounters), and in every masked encounter, the primary ICD and the LOS were masked jointly, confirming record-level rather than independent per-attribute masking (Table 2). The masking was therefore small in volume relative to the cohort, even though the admissible suppression budget was 50%, which indicates that the optimizer did not resort to aggressive deletion to reach the privacy threshold.

The masking was distributed almost uniformly across the 15 admission years rather than concentrated in particular periods (suppression_by_year.csv in Multimedia Appendix 5). Year-specific masking rates ranged narrowly from 0.70% to 0.87% at k=5, from 1.58% to 1.92% at k=10, and from 2.36% to 2.88% at k=15, with no monotonic trend across the study period. Unadjusted temporal drift in the suppression pattern is therefore minimal, and the diagnosis-level comparisons that follow are not driven by a particular admission year.

To make the detailed metrics directly usable by decision-makers and applied researchers, the per-data-element results were summarized with the composite traffic-light verdict defined in the Methods section (Table 5). For LOS, the verdict was red at all 3 thresholds because the SD changed far beyond the ±10% stability window even though the location shift was comparatively small, which is the signature of microaggregation. For ICD vocabulary, the verdict was yellow at k=5, where Jaccard overlap remained above 0.60, and red at k=10 and k=15, where vocabulary loss and frequency redistribution crossed the red thresholds. The verdict therefore communicates a consistent message. The anonymized data of this type support ordinal and comparative use of the diagnosis-to-LOS relationship but are not suitable for analyses that depend on faithful variance structure, accurate absolute LOS estimates, or complete diagnostic vocabulary.

Turning to the third RQ, the relationship between k and data-quality change followed a 2-component pattern rather than a single monotonic gradient. For LOS, the KS D and its scaled statistic, and all complementary descriptors, were essentially constant across the 3 k levels (Table 3) because microaggregation imposes its distributional footprint at the initial step and additional k increases contribute little further perturbation. For the inferential metrics, the same saturation held. The ICC attributable to diagnosis changed only marginally beyond k=5 (0.827, 0.831, and 0.837), BLUP rank concordance was stable (ρ_S 0.970, 0.966, and 0.964), and Lin CCC changed little (0.966, 0.965, and 0.959). Categorical degradation, by contrast, followed a clear dose-response gradient. Jaccard fell from 0.624 to 0.493 to 0.421, Cramer V rose from 0.062 to 0.093 to 0.114, and the number of diagnosis groups no longer estimable scaled with k (234, 345, and 425). The overall pattern is therefore a step-function for the numeric outcome, saturating at k=5, combined with a proportional gradient for categorical erosion, which tracks the suppression of rare codes (Figure 4). This pattern is a property of the present low-dimensional, 2-quasi-identifier configuration and should not be assumed to hold for higher-dimensional releases, as discussed in the Limitations and Future Work section.

However, the KS D axis in Figure 4A spans an extremely narrow range because the 3 anonymized LOS distributions are almost identical to one another (KS D=0.1467, 0.1470, 0.1470). The points therefore do not order themselves along that axis in a visually monotonic way, and this is expected rather than a sign of instability in the method or the metric. Microaggregation replaces LOS values with cluster means at the first anonymization step, which fixes the shape of the anonymized LOS distribution almost immediately, so that further increases in k change the LOS distribution only negligibly. The near-vertical arrangement of the 3 points along the KS D axis is the visual effect of this saturation. The Spearman axis, by contrast, varies smoothly and monotonically because rank concordance is sensitive to the progressive loss of diagnosis groups, which does scale with k. Read together, the 2 axes convey the central finding of the dose-response analysis, namely, that the numeric distortion saturates while the categorical erosion accumulates.

This case study produced 5 central observations. First, the distributional comparison identified a substantial LOS perturbation (KS D=0.147, SD compression of approximately 6.5 days, contraction of the upper tail) that the internal loss metric of the anonymization tool did not signal, since that metric reported aggregate geometric-mean losses below 10%. In clinical terms, anonymization shifted the median hospital stay from 4 to 5 days and narrowed the IQR from 5 to 4 days, while the diagnosis-level mean changed only modestly. This combination of a small location change with a large dispersion change would remain invisible to any evaluation relying on first-moment comparison alone, which is the core methodological point of the study.

Second, the 2 quasi-identifiers showed mechanism-specific degradation patterns. LOS distortion saturated at k=5, whereas ICD vocabulary loss continued to increase with k. These contrasting patterns are compatible with different dominant transformation mechanisms, but because ARX applies both transformations jointly, the present design supports indirect rather than formal attribution and motivates a future factorial decomposition. Third, microaggregation produced an asymmetric moment pattern. The first moment was largely preserved, while the second moment collapsed, and the upper tail was truncated, which is the expected behavior of cluster-centroid substitution applied to a right-skewed distribution. A small number of long-stay patients drives most of the variance and very little of the mean, so collapsing within-cluster variability removes those tail values almost entirely without shifting the typical value. The practical concern is therefore user-side misinterpretation rather than statistical surprise. An analyst comparing only central tendency would conclude that the data are unaffected, while any variance-dependent analysis would silently operate on a homogenized outcome.

Fourth, the inflation of the ICC after anonymization is most plausibly explained by residual-variance deflation and structural simplification, and it should not be interpreted as evidence of stronger diagnosis-associated information. The interrogation of the variance components showed that the moderate rise in between-diagnosis variance accompanies a sharp fall in the number of diagnosis groups and a near-doubling of median group size, which is consistent with the removal of small, low-frequency groups rather than with any genuine sharpening of the diagnosis-to-LOS signal. Fifth, BLUP rank ordering and aggregate magnitude agreement were both high (ρ_S 0.964 to 0.970, Lin CCC 0.959 to 0.966, each with narrow CIs). However, approximately 7% of diagnosis categories underwent sign reversals, concentrated almost entirely among diagnoses whose original effect was near 0. The headline message of reproducibility is therefore conditional. Relative ranking is robust, but the effect estimate for any specific low-signal diagnosis can be unreliable.

Building on these findings, and because suppression in k-anonymity targets records that fail to reach the k threshold, the masked encounters are not a random sample, and their characteristics were examined directly to assess potential survivor-type bias (analysis of suppressed records.R in Multimedia Appendix 1 and gradual_loss_cascade.csv and cohort_characterization.csv in Multimedia Appendix 5). Masking was small in volume, affecting under 1% of encounters at the first step and under 3% cumulatively at k=15, but it was nonrandom. It fell mainly on lower-frequency codes, with the largest within-code erosion among musculoskeletal diagnoses (eg, M85 lost 43% of its records, M72 lost 28%, and M65 lost 27%), spinal-cord and related injury (G82 lost 33%), trauma codes (S36 and M84), and one rare infection (A31, with 78% of its records removed at k=15). The masked encounters also had modestly longer LOS than those retained, with mean LOS values of 7.23 (SD 13.08), 7.39 (SD 12.58), and 7.38 (SD 12.21) days for k=5, 10, and 15, respectively, compared with 6.49 (SD 9.65), 6.48 (SD 9.62), and 6.47 (SD 9.60) days among retained encounters and 6.52 (SD 9.74) days overall. However, the median LOS remained 4 days in both groups. Because masking operates at the encounter level rather than the patient level, encounter counts reconcile exactly between the suppressed and retained groups, whereas patient counts do not sum to the cohort total, because a single patient may contribute one encounter that is retained and another that is suppressed and therefore appears in both groups (cohort_characterization.csv in Multimedia Appendix 5). This outlier-directed, rare code–directed pattern explains the survivor-type signal seen elsewhere in the results, and it is reported here as a limitation. Estimates for the specific rare or long-stay conditions most affected by masking warrant particular caution, while the aggregate distributional and rank-level results remain largely unaffected because the masked volume is small.

Beyond the statistical consequences already described, the progressive loss of diagnostic vocabulary carries clinical and ethical implications. At k=15, more than 400 three-character diagnosis categories were no longer estimable, and the analysis above shows that the categories most completely erased are precisely the rare and lower-frequency conditions. Systematically removing rare diagnoses from a research dataset risks rendering those conditions invisible to exactly the secondary analyses that are meant to serve them, such as health-services planning, capacity forecasting, and equity monitoring for uncommon or resource-intensive conditions. If anonymized administrative data are used to allocate resources or to define cohorts, the suppression of rare-disease codes can bias planning toward common conditions and against the long tail of rarer presentations, with the affected patient groups least able to absorb the resulting underrepresentation. This constitutes a fitness-for-purpose concern rather than a privacy concern, and it reinforces the argument that the suppression footprint, and specifically which clinical categories were erased, should be reported alongside any analysis of anonymized clinical data.

Taken together, for medical informaticians and data scientists, these results carry practical consequences. Mixed-model estimates from anonymized data of this type may appear misleadingly precise, with elevated explained-variance values and narrower prediction intervals that mask true patient-level variability. The roughly 10-fold residual-variance compression means that CIs derived from the anonymized data are narrower than warranted, which can inflate apparent statistical significance through a mechanism analogous to range restriction in psychometric research [54]. The inflated ICC does not mean that diagnoses explain LOS better after anonymization, only that less unexplained variability remains for them to compete against. Researchers identifying which diagnoses carry the longest or shortest stays would, in this case study, reach concordant rankings from anonymized data, but analyses requiring precise effect magnitudes, such as cost projections, resource-allocation models, or meta-analytic contributions, would be compromised by the magnitude distortion and the low-signal sign reversals documented earlier. The apparent improvement in prediction accuracy should be read in the same light. The lower RMSE on anonymized data reflects a compressed outcome, not a better model, and any prediction metric reported on anonymized data should be accompanied by the corresponding metric on the original data and by the variance ratio of the outcome.

These observations can be situated within the existing literature. Pilgram et al [13] evaluated anonymization costs in a chronic kidney disease cohort and reported that use case–specific configurations yielded higher reproducibility than generic approaches. The present study extends this by showing that even a generic configuration preserves rank-order inferential structure when evaluated through BLUP concordance, while magnitude fidelity is high in aggregate but fails for individual low-signal diagnoses. Johann et al [14] compared anonymized and synthetic heart-failure data and concluded that both degraded utility, which the present granular distributional and quantile-level characterization corroborates and refines. Jakob et al [10] evaluated a COVID-19 anonymization pipeline using distributional comparisons but did not test whether clinical associations survived the transformation, a gap addressed here by the mixed-model reproducibility layer. Ohno-Machado et al [12] showed that cell suppression preserves descriptive statistics while degrading predictive performance, which the present study sharpens by demonstrating that the diagnosis-level mean shifts modestly while the distributional structure changes substantially. The broader contemporary literature aligns with these findings. Cohen et al [15] showed in a clinical data warehouse that reducing reidentification risk required transformations that compromised the reliability of specific epidemiological statistics, and Kaabachi et al [16] documented the absence of a single agreed privacy-utility metric set across medical studies. The present contribution is complementary, namely, a transparent, tool-agnostic procedure for documenting which analytical properties a given anonymization configuration preserves and which it does not, and a reporting checklist to make that documentation routine. Kohlmayer et al [17] focused on information-theoretic loss functions internal to ARX, and the external evaluation performed here reveals quality dimensions that those internal metrics cannot capture. As with the tool-agnostic anonymity verification of pyCANON [58] and related independent utility-assessment approaches [59,60], fitness-for-purpose evaluation should be independent of the anonymization software used. Finally, the dual-metric strategy of supplementing Spearman correlation with Lin CCC operationalizes the principle of Bland and Altman [53] that correlation alone is insufficient for agreement assessment.

Several limitations should be addressed in future iterations. First, the composite verdict thresholds are based on established statistical conventions rather than calibrated against clinically meaningful differences, and a key next step is to align them with minimal important differences through expert panels and simulation. Second, although a patient-level random effect was added and admission year was used to confirm the absence of temporal drift in suppression, the random-intercept structure does not capture whether anonymization affects specific diagnosis groups differentially; random slopes or use cases with inferential targets less directly exposed to variance depletion would extend the analysis. Third, microaggregation was performed using the geometric mean so that within-cluster aggregation is consistent with the logarithmic scale on which LOS is modeled, which was used to reduce the positive bias that raw-scale arithmetic aggregation would introduce under a concave transformation. We acknowledge that a minor persistent bias may remain because geometric-mean microaggregation aligns with log(LOS), whereas the mixed model was fitted to log(LOS+1), creating a slight scale mismatch particularly at the lowest boundary where the LOS equals 1. A further residual limitation remains that microaggregation of any form compresses within-cluster variance, so mixed models fitted to microaggregated, variance-depleted outcomes may produce near-singular fits and overconfident inference. The compressed residual variance, sharply peaked density plots, very small standard errors, extreme P values, and strongly negative AIC values in the anonymized datasets should therefore be interpreted as signs that uncertainty estimates from anonymized data may represent lower bounds rather than fully reliable measures of precision. Fourth, the masking of records is nonrandom and concentrated on rare and longer-stay encounters, so estimates for those specific conditions warrant caution; pattern-mixture or tipping-point sensitivity analyses following Leurent et al [61], in the spirit of the missing-not-at-random framework of Little and Rubin [62], would test the robustness of the rank-concordance and magnitude results to worst-case assumptions about the masked encounters. Fifth, testing only 3 k values constrains the identification of inflection points, and including lower and higher thresholds, as well as further privacy models such as differential privacy, t-closeness, and l-diversity, would refine the dose-response characterization. Sixth, the evaluation used a single tool, ARX, under one configuration family, so the concept should be understood as a software-agnostic approach illustrated through a single-tool case study; a multitool comparison would substantiate the generalizability claim. Seventh, and most importantly for external validity, the retained dataset deliberately includes only 2 dimensions, primary ICD code and LOS, and excludes variables such as age, sex, and admission and discharge dates. A 2D dataset of this kind has limited standalone utility for epidemiological analyses, patient care-pathway studies, or key-performance-indicator computation even before anonymization, and the saturation of LOS distortion at k=5 is a property of this low-dimensional configuration. Applying k-anonymity to a higher-dimensional release with additional quasi-identifiers would be expected to require more suppression and produce greater utility loss, so the saturation observed here should not be generalized to such settings. Eighth, LOS served simultaneously as a quasi-identifier and as the inferential outcome, a worst-case design that makes part of the observed inferential degradation an upper bound on what analyses unrelated to the transformed quasi-identifiers would experience.

Medical informatics researchers, data integration centers, and data-protection officers should empirically verify the distributional and inferential fitness-for-purpose of any anonymized clinical dataset before secondary use. Before conducting analyses or sharing data, practitioners should apply distributional screening, including quantile-level characterization and variance diagnostics, to quantify the transformation footprint. Inferential reproducibility should then be tested for the specific association under investigation, using both rank-order and magnitude-sensitive agreement measures with CIs. Results from anonymized data should be reported alongside explicit documentation of the k-anonymity level, the complete anonymization configuration (including the transformation model applied to each quasi-identifier, suppression limits, optimization weights, and attacker models), the suppression rate and its distribution across quasi-identifiers and subgroups, the distributional impact metrics, and a statement on whether ICC inflation was observed and how it was interpreted (Textbox 1 and Checklist 1).

To support consistent reporting, we created the ADAQI checklist (Anonymization and Data Analysis Quality and Impact Reporting; Checklist 1), a structured aid of 29 items organized across 7 reporting domains, and we propose that future publications use it for standardized reporting of anonymization impact. We provide a blank template in Checklist 1 and a worked, filled-in version completed against this study as a concrete example. Completion can be confirmed with a single sentence in the Methods section, for example, anonymization impact was reported using the ADAQI checklist (Checklists 1 and 2).

In summary, this methodological case study demonstrates, using the ARX tool, a procedure that combines distributional fidelity assessment with inferential reproducibility testing for anonymized clinical data. Applied to 719,387 inpatient encounters, k-anonymity at k=5, 10, and 15 produced a measurable distributional change in LOS (KS D=0.147, SD compression of about 6.5 days, contraction of the upper tail) and progressive vocabulary erosion (Jaccard declining from 0.624 to 0.421), while preserving the rank ordering of diagnosis-associated LOS effects (Spearman ρ 0.964-0.970) and the aggregate magnitude agreement (Lin CCC 0.959-0.966). Within this preserved aggregate, a minority of low-signal diagnoses underwent extreme individual distortion, including sign reversals in approximately 7% of categories. None of these effects were signaled by the internal loss metric of the tool, which reported aggregate losses below 10%. The numeric distortion saturated at k=5, while categorical erosion accumulated with k. These findings are specific to a deliberately low-dimensional, 2-quasi-identifier worst-case design, and should not be generalized to higher-dimensional releases. The practical conclusion is that anonymized datasets of this type can support ordinal and comparative analyses of the diagnosis-to-LOS relationship, but can mislead analyses that depend on faithful variance structure, accurate absolute estimates, or complete diagnostic vocabulary. Furthermore, the analytical footprint of anonymization should be measured and reported rather than assumed. The open-source R implementation, the anonymization certificates, and the reporting checklist are available to enable independent replication. Multitool and multidataset validation constitute the next steps of the project.