This is partially true. Her data can't be used willy nilly (sp?). Hospitals and doctors offices can use this data for their internal operations, to improve efficiency, quality, etc and (honestly) profit. They can also use this data in research, but only with IRB approval for exemption from consent. Her data should be protected!

Also, I would add that the data collected for routine patient care is often of significantly lesser quality than that collected as part of organized research studies. This is because in a research study, all patients get the same studies and tests whereas in clinical care, they only get what they need, so there is significant amounts of 'missing' data.