If the reports contain only aggregated or de-identified data (i.e. no PHI) then that is fine.