Every patient in the public tour of my care platform is a computer science pioneer. Ada Lovelace has a pain score. Alan Turing is due for a check-in. And every one of them has a patient ID no real system could ever issue, an ID that is wrong the way a date in month thirteen is wrong. None of this is an accident. It is the most useful compliance idea I have had this year.
A good fake is a liability
Here is the problem with realistic demo data. Under HIPAA, nobody can tell a well-made fake from the real thing by looking. A screenshot of a fake patient named John Smith with a plausible ID looks exactly like a screenshot of a real one. So when that image turns up in a deck, or a tweet, or a forwarded email, someone has to prove it is clean. And the only way to prove it is to go back to the database and show the record does not exist. That is an audit. Every plausible fake carries a future audit inside it.
So a good fake does not reduce your risk. It just moves it. The better the fake looks, the more it costs to prove it is one. The safety of a fake is not in how real it looks. It is in how obviously fake it is.
A plausible fake needs an audit to clear it. An impossible fake clears itself.
