According to the article:

> It also includes a line stating that with permission from the city agency, Palantir can “de-identify” patients’ protected health information and use it for “purposes other than research”.

Under HIPPA, "research" has a very specific definition which renders "purposes other than research" quite broad. Yes, it's "with permission" but it does depend on the city agency fully understanding what ancillary things Palantir can do with de-identified data once it has left the covered entity and without further explicit permission.