> I was very much more intrigued about the statement that data can’t be easily/legally shared within the same agency

Consider it from this hypothetical perspective: My mom is an analyst in the health service and has database access to produce various reports. Her access is extensive, to allow reporting on things like whether the courses of antibiotics prescribed by doctors are of the recommended length.

Meanwhile, I'm a rebellious teenager. My doctor asks me how often I smoke, drink, take drugs and engage in promiscuous sex. If my doctor enters my answers into my electronic medical record - should my mom be able to look at my record?

The answer, of course, is that her right to access data depends on what she's doing.