It is a clear cut HIPAA violation if the data sold to the data aggregator contained personal identifiers of any kind. The standard is not that data be "anonym

It is a clear cut HIPAA violation if the data sold to the data aggregator contained personal identifiers of any kind. The standard is not that data be "anonymized" but that all personal identifiers be redacted from the data. This includes dates, addresses (typically the finest grain of address information you can include is the first 3 digits of the zipcode, and sometimes not that), birthdays. The redaction does not mean that data cannot under some circumstances be re-identified, of course. But it's not trivial.