The Limits to De-Identification of Clinical Data