Anonymous data has been collected on patients for ages. This is how we know things like how many people are diagnosed with sepsis/year, how many die and what treatments make the biggest difference in outcomes. This is no different.
there are many many levels of research. and many many rules, regulation and even international treaties.
There are national and state laws and regulation in place that require reporting of certain datapoints. they are always in place and ongoing. we are in a declared public health emergency - many standard rules are modified. allowing increased data collection.
regardless there is no limit on de-identified data collection, aggregation, and determination. Provided there is no experimental processes going on without consent.
if there is experimental treatment or medication use the patient (or person with legal authority to speak for the patient) still must be provided with education and consent. If the patient cannot answer and there is no designated proxy there re systems in place to obtain consent - those vary by state.
Uninformed patients leading unexamined Life
As far as COVID cases go, I’m sure they could cite it being a matter of national (and global really) security.
We have had the same discussion regarding informed consent related to experimental treatments with antibody infusions. Currently we are not obtaining consents but are documenting a standard education form was handed to the patient. I'm not sure how this is legally safe and have had the same question.