Exactly. I've been through IRB reviews where the primary question was "Has the data been de-identified to a sufficient standard?"

I think this level oversight would be very appropriate here, given how the author doesn't even seem to have a good handle on how many patient case histories he's given to the chatbot.