So don't include information that isn't necessary. rm name/age/gender.

If it's the organization's in-house medical number, that should be okay. It's literally a random identifier number. Or better yet, use a visit number, test number or result number to avoid linking them together.