Comment by nradov

HHS publishes clear guidelines for de-identifying healthcare data (PHI). Once it has been properly de-identified (anonymized) it is no longer subject to any special controls. I am aware that some researchers have claimed that it could be theoretically possible to re-identify certain records but so far no one has been able to do so in practice so concerns seem to be overblown.

https://www.hhs.gov/hipaa/for-professionals/special-topics/d...

As for Medicare, only a very limited set of data is publicly available. Larger sets are available to certain contractors and researchers but the access agreements prohibit sale to third parties. So you must have misinterpreted the content or source of the data you saw.

https://www.cms.gov/data-research/cms-data/types-data-files