The incentives are with collecting data that insurance companies will not reject your payments over. If an insurance company noticed you're mis-billing then you lose money. They may request full medical records of patients to verify. Which incentives generally clean data although there are biases such as up billing and spurious diagnosis to get medication covered. Medical records themselves are a mess often but billing data is better since a lot of money is on the line.

>That sounds like it would be a trivial to de-anonymize.

In theory yes if you joined to other identified data sets but in practice doing so makes it a massive HIPAA violation with very large government enforce penalties. There's also enough contractual sanity checking and costs that no one who gets access would bother.