Notice that we're talking about de-identified patient data here. There is a utility/privacy trade-off when using data containing private information: on the one hand, the patient's personal information must absolutely be protected, on the other hand, many processes could benefit from the information in such a data collection even without the knowledge of which data point belongs to which individual.

If de-identification is done right, it would be a bit of a stretch to talk about "surveillance" because that's the whole point of de-identification: remove any information from the records that allows a third-party to identify the underlying person from whom the data originated. Note especially that this includes inference attacks, i.e., not only should any occurrences of names be removed/masked but also any information that would allow an informed attacker to re-infer that information, i.e., cross-link the patient data back to a specific person.

The big elephant in the room, however, is the "If" at the beginning of the previous paragraph. As far as I see it, the problem lies not in wanting to establish some functionality that actually uses the collected information but whether appropriate privacy prerequisites have been put in place prior to that.