This coversion is muddied by a failure to distinguish confidential information ("I have disease X"), from identifying information (my name/address)

It seems that in this case we are talking about "personal confidential data", which includes both.

Their main page, http://www.hscic.gov.uk/dlesaac , states

> Personal confidential data is data in which individuals are clearly identified, or there is a high risk of individuals being identified. This includes patient identifiable data, such as: NHS number, Name, Adress, [...] Personal confidential data also includes sensitive data which may include items such as: Racial or ethnic origin, Political opinions, Physical or mental health condition, [...]

Why kind of shitty low rent person lends thinks it's ok to work on this stuff?

Imagine a researcher working on suicide prevention. We have good suicide statistics in the UK. The publicly released data contains some gaps. Where less than 5 people die by suicide in an area you only get the numbers of people that died and not any ages or genders. That's because it is possible to identify an individual if the age and gender is released.

But for our researcher these bits of information are important, so they apply and are assessed and they get access. And now their stats will include the age ranges and genders for the towns with less than 5 deaths.

Note that names or postcodes or etc are not included. Just the number of people dying by completed suicide; their age range; and their gender.

Medically identifying is inerpreted broadly because we know about the risks of seanonymizing data, and so small details can be identifying and not released without cautious assessment.

If you read the PDF: "Bespoke extract – containing personal confidential data: A one-off extract tailored to the customer’s requirements of specified data fields containing patient identifiable data, sensitive data items or both."