Doing this sort of thing would typically require approval from an ethics committee (called IRB = Institutional Review Board). From my experience of going throu

Doing this sort of thing would typically require approval from an ethics committee (called IRB = Institutional Review Board). From my experience of going through IRB reviews, I would guess that an IRB review for what's described in the blog post would be focussed on the privacy of subjects whose data is to be entered into a non-HIPAA-compliant third-party system. My understanding is that privacy requirements can typically be met either by de-identifying the data to a certain standard, or obtaining patients' consent. The following doc is about a different type of thing (case reports in medical journals) but gives a good idea of the required standard of de-id: https://hipaa.yale.edu/sites/default/files/files/Case%20Reports%20and%20Patient%20Privacy.pdf https://hipaa.yale.edu/sites/default/files/files/Case%20Repo...