You certainly read a lot into that statement. Who said the data isn't anomymized and deidentifed? It's not a matter of just stripping identifiers off data and sending it off left and right, even then it's better to control access in a central, secure area. Even if you've deidentifed to an individual level there's inherent risk, that's why accessing even "public" datasets like Mimic III is still process heavy.