“Probably no patient identifying data - just a number.”
You can individually identify people without a number. Just correlate their medical condition, the time it was reported, and their geographical location.
Our wait for a hacker to connect the two.