Folks, if someone in the US wants to study a group of people with a a certain condition, they go to an IRB to get permission. They have to decide if the research will use identifiable information. If the data contain identifiers, you essentially always have to get permission from each and every patient, and that permission has to be specific to the exact use of their data.
You don’t “make a registry” of everyone with a disease. Bad people do that. Nazis. Insurance execs. Bad people.