A count of four people with a condition at one site can be enough to identify them, especially in a small community or alongside other published figures. Health agencies, statistical offices and payers have rules for this. Applying them correctly is harder than it looks, because a hidden number can often be worked back out from the numbers left visible.
Why small counts are a risk
Small counts matter for two reasons. The first is disclosure: when a group is small, a reader who knows something about one member, such as their age, location or the fact that they were treated, may be able to learn something new about them. The second is reliability: a rate based on a handful of events moves a long way when one event changes, and readers tend to over-interpret it. These are separate problems with separate rules, and a published table must pass both.
The rules in common use
- CMS cell size suppression. For data derived from Medicare and Medicaid, CMS does not allow any cell containing a value of 1 to 10 to be reported directly, and also prohibits other values, such as percentages, from which such a value could be derived [1].
- CDC WONDER. Counts and rates representing fewer than 10 persons (1 to 9) are suppressed in its mortality data. As of 2026, rates are flagged as unreliable when the relative width of the 95% confidence interval exceeds 160%; before February 2026, the rule was fewer than 20 deaths, roughly equivalent to a relative standard error of 23% or more [2].
- NCHS standards for proportions. NCHS recommends suppressing estimated proportions with an effective sample size below 30, and uses the absolute and relative width of the confidence interval (Clopper–Pearson, or Korn–Graubard for complex surveys) to decide whether to present, flag or suppress an estimate [3].
Rules differ by source and change over time, so a publication process should state which rule it applies and take the threshold from that rule rather than from habit.
Hiding one cell is not enough
Consider Table 1. The count of 4 must be hidden under a 1-to-10 rule. This is primary suppression.
| Outcome A | Outcome B | Total | |
|---|---|---|---|
| Site 1 | 4 | 37 | 41 |
| Site 2 | 22 | 19 | 41 |
| Total | 26 | 56 | 82 |
Table 1. A small table with one count below the threshold.
Hiding only that cell protects nothing: the row total is 41 and the other cell is 37, so anyone can compute 41 − 37 = 4. To protect it, further cells must be hidden so that no row or column has exactly one unknown. This is complementary (or secondary) suppression [4]. In this table, hiding the 4 forces hiding 37 in its row, 22 in its column, and then 19, so all four interior cells are suppressed while the totals remain.
| Outcome A | Outcome B | Total | |
|---|---|---|---|
| Site 1 | · | · | 41 |
| Site 2 | · | · | 41 |
| Total | 26 | 56 | 82 |
Table 2. The same table after primary and complementary suppression. The dots mark hidden cells, each with the same public reason.
The same risk appears in less obvious forms: a percentage beside a total, a rate with its denominator, a figure that can be subtracted from a year-to-date total published last quarter, or two reports that break the same population down differently. CMS’s rule explicitly covers values derived from other reported cells [1].
Auditing a suppressed table
Choosing which cells to hide is only half the job. The other half is checking what an attacker could still learn. For each hidden cell, the question is: given every published total and visible cell, and knowing that counts are whole numbers and never negative, what is the smallest and largest value the hidden cell could take?
In Table 1 with all four cells hidden, the totals leave one free quantity. Calling the hidden small cell t, the others are 41 − t, 26 − t and 15 + t. Non-negativity limits t to between 0 and 26. An attacker learns only that the count lies somewhere in that range, which is adequate protection.
In larger tables, computing these bounds by hand is impractical. It is a linear programming problem: minimize and maximize each hidden cell subject to the published constraints [4]. Disclosure-control software computes these feasibility intervals and compares them with the protection each cell requires [5]. Because counts are integers, integer constraints can pin a cell more tightly than the linear relaxation suggests, so a careful audit confirms the bounds with whole-number solutions. If any hidden cell can be recovered exactly, or narrowed to within the protected range, more cells must be hidden and the audit repeated.
Reliable is a separate question
A count can be safe to publish and still too unreliable to interpret. A rate built on a few events, or an estimate whose confidence interval is wider than the estimate itself, invites readers to see differences that are noise. Reliability rules, such as NCHS’s sample-size and interval-width criteria [3] and CDC WONDER’s relative-width flag [2], decide whether an estimate is shown plainly, shown with a flag, or withheld.
Judging reliability requires the numerator and denominator, and for survey data the design: strata, clusters and weights. A process that only receives the final rate cannot apply these rules, so the components should travel with the estimate until the decision is made.
A practical checklist
- Name the rule that applies to each source, with its threshold, and keep that choice with the publication.
- Apply primary suppression to counts, and to every value from which a protected count can be derived.
- Apply complementary suppression so that no row, column or published total leaves a single unknown.
- Audit the result: compute the feasible range of every hidden cell and confirm none is too narrow.
- Consider linked publications: the same population broken down differently, or the same table published again later.
- Give readers one consistent reason for every hidden cell, without revealing which rule hid it.
- Judge reliability separately, from the numerator, denominator and design, and flag or withhold accordingly.
Sources
- CMS Cell Size Suppression Policy, as published by ResDAC. resdac.org
- CDC WONDER, Underlying Cause of Death: notes on suppression and reliability. wonder.cdc.gov
- Parker, J. D., et al. (2017). National Center for Health Statistics Data Presentation Standards for Proportions. Vital and Health Statistics 2(175). stacks.cdc.gov
- Federal Committee on Statistical Methodology (2005). Report on Statistical Disclosure Limitation Methodology, Statistical Policy Working Paper 22 (second version). apps.bea.gov
- Statistics Netherlands (2014). τ-ARGUS User’s Manual, version 4.1. research.cbs.nl