Having looked at similar contracts (specifically UofC's CrimeLab running analysis of police data against UofC hospital xray data), the pairing is required to be done on a host such that the xray data never leaves the UofC imaging infrastructure. Contractually, at least. Not exactly sure where your questions are coming from.

yeah, that happens. the researchers hate it (the service provided is often inferior to their own in-house setup) and it's mainly to retain some level of funding for the lab, rather than benefiting the most users. Also, university infrastructure is far less secure than a cloud account run by a cloud provider.