When I worked for a hospital we paid a 3rd party to anonymize data re employees. We self-insured so we had all the claims data but knew breaching that wall was highly unethical- even if not for nefarious purposes!