> As long as they de-identify the records — removing information like patient names, locations, and phone numbers — they can give or sell the data to partners for research.

I don’t feel this is enough to deidentify.

If timestamps or a patient # is associated with records, should be possible to combine with credit card records to discover who someone is.

I wonder if we can request what is shared.