While not well-known, this is quite common and legal practice. Insurance and pharma companies have been buying deidentified data for years now. It is usually on

While not well-known, this is quite common and legal practice. Insurance and pharma companies have been buying deidentified data for years now. It is usually only for the purposes of research. HIPAA itself has deidentification guidelines which must be followed. They aren't fool-proof though, there have been some successful attempts at reidentification. Ironically many of the contracts specify that you cannot try to reidentify the data you buy.