It's not made entirely clear in the article, but most of this data is insurance claims data, not medical records per se. That's why employers have it. If your employer underwrites your medical claims directly - which most do nowadays - when you or your doctor submits an insurance claim, they are submitting it to your employer. It may go through a health insurance company - since most employers hire one to administer their plans - but that insurance company is collecting the information on behalf of the plan owned by your employer. The fact that it's insurance claims and not raw medical records is one of the challenges IBM had in making a business out of analyzing it. There is a lot less and less quality, medical data in insurance claims than IBM hoped.