The American public continues to be concerned about medical privacy. Health organizations need personally identifiable data to make care decisions; yet identifiable data are often the basis of information abuse. This book shows how de-identified data may be used for important healthcare operations. A technology adoption model is constructed to explore if a for-profit health insurer could use de-identified data. A close data analysis finds support for adding privacy protections to the insurer's quality-of-care applications. A cost-benefit model is constructed describing the Predictive Modeling application (PMA), used to identify the insurer's chronically-ill policy-holders. The model quantifies the decline in policy-holder care and rise in the insurer's claim costs as the PMA must work with suboptimal data due to policy-holders' quality-of-care privacy concerns. A new encryption approach to link records despite linkage variable errors is constructed. It's tested as part of a general data de-identification methodology--and an actual PMA's performance is found to be the same as if executing on identifiable data. That is, key medical applications can be run on de-identified data.