Which anonymization method provides the strongest mathematical privacy guarantee (ensures patient data cannot be reconstructed)?