decision

Most of a compliance method is the wrong amount to implement

2026-07-19 · WASH-110

The question

One geography mode keeps the first three digits of a US postal code. The published de-identification method it resembles additionally requires that the small number of low-population three-digit prefixes be zeroed. The list is static, short and cheap to implement. Should it be?

Constraints

  • Implementing it is genuinely easy — the list is fixed and small, so effort is not the reason it is absent.
  • The mode exists because a three-digit prefix carries the rating-area signal that payer logic consumes, while a full postal code is the most re-identifying geographic field.
  • The tool is not a de-identification method and every surface says so. That framing is the product's main protection against being read as a compliance control.
  • The mode is deliberately named for what it does — keep region — rather than after the published method it partially resembles.

Alternatives considered

  • Implement the prefix list and keep the framing exactly as it is.

    Rejected — Defensible and still open. It strictly reduces what is emitted, and if the framing does not move, nothing is overclaimed.

  • Leave it out and let the mode remain an explicitly non-compliance control.

    Rejected — Also defensible and the current state. The mode's name and the surrounding copy already refuse the compliance reading.

  • Implement the prefix list AND describe the mode using the compliance method's name.

    Rejected — Ruled out. This is the one pairing that is worse than either half alone — it is the precise overclaim the tool's framing exists to prevent, and it would invite a reader to rely on the mode for something it does not do.

The decision

Open, with one branch closed. Either implement the prefix list and leave the framing untouched, or leave both alone. Do NOT implement it and soften the framing — that pairing is the one bad outcome.

Why an unresolved decision is worth publishing

Because the structure of it is settled even though the choice is not, and the structure is the transferable part.

Most compliance-adjacent features are discussed as a single axis — implement it or do not. This one has two axes, behaviour and framing, and three of the four combinations are fine:

Framing unchanged Framing softened
Prefix list implemented Fine — strictly less is emitted The one bad outcome
Not implemented Fine — current state, honestly named Fine, if odd

The failure mode is not under-implementing. It is implementing most of a method and letting the increased coverage license a stronger claim. A tool that does most of a compliance method and hints as much is more dangerous than one that does none of it and says so, because a reader can calibrate against the second and not the first.

The general rule this is an instance of

Partial implementation of a named method must not license partial adoption of its name. Coverage and claim are independent, and coverage improving is not permission for the claim to grow.

That is worth having as a standing rule because the pressure always runs one way: each increment of coverage makes the stronger claim feel more nearly true.

Where this is canonical

docs/backlog/PLAYBOOK_DERIVED_BACKLOG_CANDIDATES_2026-07.md — Still OPEN as a decision. The register entry is canonical; this record is a dated snapshot of the reasoning and states the one pairing that is ruled out.

Related

Back to Decisions