Anonymising HR Stories Without Losing Operational Truth: The Context-Banding Method

Why "Names Changed" Fails: The Solo-HR Jigsaw Equation

Removing proper nouns is pseudonymisation, not anonymisation. When an author's employer history is public or discoverable, three benign background facts shrink the candidate pool to a single recognizable worker.

Every week in practitioner Slack channels and conference workshops, an experienced HR leader opens a case study with five dangerous words: "Names changed to protect privacy." Ten seconds later, the speaker mentions "our 135-person Series B climate-tech startup in Denver during last November's reorg" and describes "a principal hardware engineer requesting an eight-week inpatient accommodation." Anyone sitting in that room—or reading a screenshot forwarded to the company's General Counsel—needs zero private databases to unmask both the company and the engineer.

Formal privacy science proved why decades ago. Computer scientist Latanya Sweeney demonstrated in her landmark 2000 re-identification audit that 87% of the United States population (216 million of 248.5 million residents in Census data) was uniquely identified by just three quasi-identifiers: 5-digit ZIP code, gender, and date of birth. Inside employment practice, the math is far harsher because two structural multipliers compress the denominator:

1. The HR-of-One linkage vector: In HiBob's multi-market HR survey (n = 3,200 HR professionals, 2023), roughly 1 in 5 practitioners (20%) reported operating as a solo HR department of one. Even under a pseudonym, if a story reveals exact industry niche, headcount, and metro area, a search across Crunchbase and LinkedIn isolates a handful of firms—and a single HR seat.
2. Internal "motivated intruder" knowledge: Under the UK Information Commissioner's Office (ICO) anonymisation standard (implementing UK GDPR Recital 26), re-identification risk is not tested against a random stranger on the street. It is tested against a motivated intruder—including a coworker, line manager, or former employee who already knows internal timelines, org charts, and office folklore.

Do the cohort arithmetic on a 150-employee company. Suppose 22% of staff sit in Engineering (33 people), 15% of Engineers hold Staff/Principal rank (5 people), and 1 person took an unplanned multi-week leave in October. Publishing "a senior engineer who went out on sudden leave in Q4" inside an identifiable company produces k = 1. You have published an identifiable medical fact about a specific human being.

Statutory Red Lines: ADA § 12112(d)(3)(B) and Adapting HIPAA Safe Harbor

Most employers are not HIPAA covered entities for general personnel records, yet ADA and FMLA confidentiality rules impose an even tighter operational gag on medical facts. Adapting HIPAA's 18-identifier safe harbor gives HR a mechanical scrubbing checklist for prose narratives.

Start by clearing up the most common statutory confusion in people operations. Routine HR accommodation files and FMLA certifications held by an employer in its capacity as an employer are not Protected Health Information (PHI) under HIPAA (45 CFR § 160.103), unless pulled from a self-insured group health plan. Practitioners sometimes breathe a sigh of relief on learning HIPAA does not govern their leave inbox—and walk straight into the Americans with Disabilities Act.

Under 42 U.S.C. § 12112(d)(3)(B), 29 CFR § 1630.14(c)(1), and FMLA rule 29 CFR § 825.500(g), any information relating to an employee's medical condition or history obtained through a disability inquiry, interactive accommodation process, or leave certification must be kept strictly confidential with only three narrow statutory exceptions: (1) supervisors who need to know work restrictions and accommodations, (2) first-aid and safety personnel if emergency treatment may be needed, and (3) government officials investigating compliance. Notice what is missing from § 12112(d)(3)(B): there is zero exception for "sharing war stories at an HR roundtable" or "training new managers using last quarter's real case." Courts hold that unauthorized disclosure of confidential medical facts causing tangible injury violates § 12112(d) even if the underlying worker was not ultimately found disabled.

While HIPAA does not supply the legal penalty for HR leave files, HHS's Safe Harbor de-identification rule at 45 CFR § 164.514(b)(2) supplies the best operational scrubbing grammar ever codified. Under § 164.514(b)(2), data is de-identified only when 18 categories of identifiers are stripped and the custodian has no actual knowledge that the residual information could identify the individual alone or in combination. Adapted to workplace prose, four rules become mandatory:

• Dates narrower than a year: Strip exact calendar dates, months, and holidays ("the Tuesday before Thanksgiving 2025") and replace them with operational sequence clocks ("Day 1 of intake," "Day 14 cure deadline," "Week 12 of leave").
• Sub-state geography: Strip cities, suburbs, and building landmarks ("our Culver City studio") in favor of statutory jurisdiction bands ("a California employer" or "a US multi-state workforce with New York staff").
• Unique titles and rare events: Never name singleton roles ("VP of Tax," "Lead Crane Operator," "Head of Design"). Abstract to the statutory classification ("an FLSA-exempt department director" or "a safety-sensitive hourly operator").
• Clinical diagnoses: Strip every rare diagnosis, surgery type, or inpatient facility detail ("Type 1 diabetes ketoacidosis" or "bipolar mania") and replace with the functional accommodation mechanic ("an episodic endocrine condition requiring intermittent leave" or "a non-apparent clinical restriction affecting night shifts").

The 5-Axis Context-Banding Architecture: Preserving Statutory Truth

Naive anonymisation ruins HR writing when authors erase the statutory thresholds that control the legal answer. Context banding solves that tension by widening identity clues while locking exact statutory coverage boundaries.

If you strip every detail out of a workplace story—"Someone at a company asked for time off and management said no"—the story becomes useless to a practitioner. You cannot tell whether the company had 14 employees or 60, whether FMLA's 50-employee/75-mile rule applied, or whether California's CFRA five-employee threshold controlled. That is why editorial standards built for serious HR craft replace vague fog with Context Banding.

A lawful context band maps every case attribute onto the widest bucket that preserves 100% of the controlling legal and operational rule while expanding the matching employer population to k ≥ 500 companies nationwide:

1. Headcount Banding (Keyed to Statutory Cliffs): Never write "our 63-person firm" or "our 412-employee plant." Band headcount strictly to statutory coverage cliffs: 1–14 staff (below Title VII/ADA/PWFA federal floor), 15–49 staff (Title VII/ADA/PWFA covered; below federal FMLA), 50–99 staff (FMLA covered; below federal WARN), 100–499 staff (WARN & EEO-1 covered mid-market), or 500+ staff.
2. Jurisdiction Banding (Keyed to Legal Regime, Not City): Replace "Austin," "Brooklyn," or "Shoreditch" with the smallest controlling legal unit: "a Texas private employer governed by federal FLSA baseline rules," "a New York City employer subject to NYSHRL and NYCHRL," or "an England & Wales employer under ERA 1996."
3. Sector Banding (Keyed to Operational Physics, Not Crunchbase Tags): Replace "Series B developer-observability SaaS" with "venture-backed B2B software" or "24/7 multi-shift healthcare logistics." Keep shift structure (salaried remote vs. fixed-rig floor shift), drop the investor pitch.
4. Tenure & Pay Banding: Replace "hired 7 months ago at $142,500" with "under 12 months of service (FMLA-ineligible, PWFA-covered), salaried exempt above the HCE threshold."
5. Composite Perturbation of Non-Dispositive Color: Alter non-statutory texture—such as whether the slack message arrived on a Tuesday or Thursday, or whether the product team shipped billing software vs. analytics—while never inventing statutory facts or agency outcomes. Note that before publishing external pieces under your own name, you must also clear contractual NDA and *Upjohn* privilege duties covered in our practitioner case-writing legal clearance guide.

Pre-Publication Motivated-Intruder Audit Log

Run every training vignette, peer-forum post, or article draft through a scored five-point clearance log before a single word leaves your scratchpad. If a coworker sitting two desks over could recognize the protagonist, the draft fails.

Pay special attention to Row 5 in the table above: verbatim text strings. Even if you strip every name, date, and city, pasting an exact 14-word sentence from a termination email or Slack message creates a cryptographic fingerprint inside the employer's e-discovery archive or Slack Enterprise Grid search. Always paraphrase dialogue into functional mechanics unless quoting a public court docket. Use this pre-publication clearance log before sharing any case externally or across internal training cohorts.

CONTEXT-BANDING & RE-IDENTIFICATION CLEARANCE LOG
Draft / Training Vignette ID: [Ref #]   Reviewer: [Initials]   Date: [YYYY-MM-DD]

[ ] 1. BYLINE-TO-EMPLOYER LINKAGE CHECK
    - If published under a named byline, could a reader cross-reference my LinkedIn employer history to narrow the company pool below k = 20?
    - Mitigation applied: [Protected/pseudonymous byline OR composite across 3+ multi-employer patterns]

[ ] 2. STATUTORY BANDING CHECK (5 AXES)
    - Headcount replaced with statutory cliff band (1–14 / 15–49 / 50–99 / 100–499 / 500+): [YES]
    - Geography widened to state/national legal jurisdiction (zero city/neighborhood): [YES]
    - Industry widened to operational sector (zero niche sub-category or funding round): [YES]
    - Calendar dates converted to relative Day-0 / Day-14 operational clocks: [YES]
    - Singleton job titles converted to exempt/non-exempt & supervisory tier: [YES]

[ ] 3. ADA § 12112(d)(3)(B) & HIPAA § 164.514(b) MEDICAL SCRUB
    - Zero clinical diagnoses, surgical procedures, medications, or facility types named: [YES]
    - Condition expressed solely as functional workplace restriction or leave cadence: [YES]

[ ] 4. VERBATIM STRING & UNIQUE INCIDENT SCRUB
    - Zero searchable verbatim email/Slack quotes from private workplace systems: [YES]
    - Zero news-searchable external events (fires, viral PR crises, named dockets unless public-record analysis): [YES]

[ ] 5. MOTIVATED-INTRUDER TEST (ICO STANDARD)
    - Question: If the employee's direct manager or peer read this text today, could they identify the individual with reasonable confidence?
    - Result: [MUST BE NO — if uncertain, abstract into a multi-case structural composite or hold publication]