PHI must only be collected on platforms that are certified for PHI. Collection PHI on platforms not certified for PHI is a HIPAA violation and a good way to get sued for all of your dollars x10, as well as criminal proceedings.

Fully-anonymized PHI can be analyzed on anything but the anonymization process must also be certified to have a reasonably low risk of re-identification when combined with other (arbitrary) datasets.

(source: I used to implement and certify PHI data collection platforms.)