Data de-identification: Best practices in the new age of regulation