The federal government has specific guidance on how to meet the legal criteria for de-identifying clinical data. Once researchers meet that standard they're generally free to publish raw data, unless there's a stricter standard imposed by state law or some sort of institutional review board.

https://www.hhs.gov/hipaa/for-professionals/privacy/special-...