But surely, as the other poster mentions, they'd be tracking patients by some unique ID and someone has the key. Otherwise, how do you correlate blood results with any other patient data?

I mean, they could go back to the provider of the clinical information with a unique ID and request follow-up. But people are still a) busy (clinical data may come from a hospital that has little interest in research; researchers want to publish and move on); b) extremely scared of making mistakes (to the point of delusion: wanting data/results to never change, even if its an improvement - because that implies there was something wrong in the past). Getting follow-up clinical data may also be out of scope of existing agreements.