As someone more familiar with HIPAA than the average lay person (but far from an expert). There's a lot that HIPAA does to both restrict access to data and ens

As someone more familiar with HIPAA than the average lay person (but far from an expert). There's a lot that HIPAA does to both restrict access to data and ensure that's it's shared freely among institutions. It's kind of this weird open-secret system that works because people get fired for even minor offense. I don't know what life was like before HIPAA, but after HIPAA it creates a lot of risk aversion. These seems to come out in two ways: * Risk of identifiable information leaking via a published report. Anonymizing data is much harder than most people anticipate. * Internal auditing and appropriate use. "Opening" a patient's record has to either be (1) for their care (2) an explicitly permitted use from the patient (research). That means while an institution must be a steward of their patient's data, they cannot simply use it however they want. This isn't much different AWS's handling of customer databases. While AWS keeps all of the data on their servers, they don't really have access to it.