The US federal government requires users to agree to terms in return for receiving potentially identifiable data. Usually those terms include something like, "

The US federal government requires users to agree to terms in return for receiving potentially identifiable data. Usually those terms include something like, "I agree to not attempt to use these data to identify any individuals." Granted, an agreement carries more weight when it's with the federal government (lying to them is criminal). But this kind of clause can prevent legal groups from reliably trading in identified data, even if it's from a private hospital. If they break the agreement, they'll probably never again receive new data from the provider, and stale data is low value.