Yep - de-identified data is the best way to assure compliance when developing/working-on/dealing with large sensitive data-sets.

that said, compliance audits are pretty strict if they are doing it correctly, and not-so-fun. It will be an interesting world when there is a medical-data-firehose pointed at an AI that is looking at all the available med records to do predictive analytics against an entire population....

We are likely a decade from that.