Edit: I think I found the statement from the org who has the sensitive data ... https://surgisphere.com/2020/05/29/response-to-widespread-re...
It includes:
> We also take data privacy very seriously. Our registry is an aggregation of customers who use our QuartzClinical data platform. Our strong privacy standards are a major reason that hospitals trust Surgisphere and we have been able to collect data from over 1,200 institutions across 46 countries. While our data use agreements with these institutions prevents us from sharing patient level data or customer names, we are able to complete appropriate analyses and share aggregate findings to the wider scientific community.
And...
> We believe that an independent academic audit that validates those three functions as it relates to our papers in the New England Journal of Medicine and The Lancet will bring further transparency to our work, further highlight the quality of our work, and also continue to deserve the confidence of our work by our colleagues.
>
> This process will follow strict boundaries as it relates to our data use agreements, among other considerations. We are pursuing such an independent audit with all due haste while ensuring compliance with various legal and regulatory concerns. [my emphasis]