Yeah

But one of the authors said they weren't able to make the data available because on contractual arrangements. I think the IRB would at least dig into that (and I'm breaking out into hives again typing IRB).

EDIT - anytime we dealt with data, even if it didn't include PHI, the IRB and wanted to look at it and make sure we weren't actually pulling PHI, they never took our word for it. And when we dealt with the third parties, they usually looked into the contracts to determine what was the use case for the data, who owned the data when the study was over, etc. Granted, our IRB process was tough but thorough (said in my Maude Lebowski voice), and maybe that was just us, but rarely did we go through the submission without someone stopping us to ask the data questions. Even my pissant grad school study on Demographic use of Epic Tools caught their eye, even though it wasn't PHI, they couldn't get past the Demographics and EMR data. We had to explain exactly what fields out of Epic were being pulled and how they were being used. We didn't pull ages, we used age bands, etc, but that was not a fun process, and that was for a silly grad school study, not the ones I did for work.