they are all anonamised and are under very strict data protection rules and regulations.
Baaaahhhhh the sort of NHS databases your DH may be working with are typically pseudonymised, not anonymised. Eg name and address might be stripped out, but patient's NHS number left in.
A few years ago, during the row about care.data, and NHS data being sold to insurance companies, it became clear that ministers and the NHS data miners had been blithely saying "anonymised" when they meant "pseudonymised".
Ben Goldacre's article here is worth reading.
Care.data is in chaos. It breaks my heart
www.theguardian.com/commentisfree/2014/feb/28/care-data-is-in-chaos
This paper from the ICO explains a bit more (I haven't read it all):
Anonymisation: managing data protection risk code of practice
ico.org.uk/media/1061/anonymisation-code.pdf
This can be a particular vulnerability where pseudonymised data sets are concerned, because even though pseudonymised data does not identify an individual, in the hands of those who do not have access to the ‘key’, the possibility of linking several anonymised datasets to the same individual can be a precursor to identification.
Regarding strict data protection rules and regulations...
Unfortunately, as Dominic Cummings has demonstrated to the entire country recently, he simply does not give a damn about the rules. He doesn't even give a damn about being caught.