The problem is risk. HIPAA allows for a lot of things that feel like exceptions to the core principles of HIPAA. Many things are vaguely defined as "reasonable"

The problem is risk. HIPAA allows for a lot of things that feel like exceptions to the core principles of HIPAA. Many things are vaguely defined as "reasonable" - which changes over time. MD5 was a reasonable password hash - until it wasn't. SHA1 was - until it wasn't. Etc. An article like this can arguably prove that there is no reasonable means of de-identification since multiple data sources can be combined. Combine that with the fact that HIPAA puts pretty high limits on the minimum cohort size that can be associated with a unique identifier and low ROI from actually sharing this data. Many places end up in a position where it's simply not worth the risk to share.