Having worked in a hospital and undergone HIPAA training multiple times, I can assure you there are pretty strict rules about passing along identified data. Wh

Having worked in a hospital and undergone HIPAA training multiple times, I can assure you there are pretty strict rules about passing along identified data. What the drug companies are purchasing is anonymized; they have the data about patient X, but they have n idea who that person is. They are literally purchasing only the chance to pass along a request through your doctors to see if you'd be interested in participating in a study if you meet some criteria.