Researchers flag privacy risks with de-identified health data