I think its the same methodology as in personal anonymity - an institution is an "artificial Person"/ legal entity.

So you have to enforce k-anonymity.

An exception can be made with legal entities in the public domain, where public accountability and public interest is ascertained by law.

Many thanks Gottfried Endel for the insight. I need to do further reading on k-anonymity though.

simple description:

consider for a defined question which parameter to aggregate to end up with 3 (5) "identical" datasets.

aggregate by region - three companies in the region

aggregate person data by age - larger age groups

aggregate institutions in rural/urban

aggregate by health outcome - ICD capital or group

So it depends on your data and your question