The research, conducted over two months at Duke University’s Sanford School of Public Policy, which studies the ecosystem of companies buying and selling personal data, consisted of asking 37 data brokers for bulk data on people’s mental health. Justin Sherman, a senior fellow at Duke’s Sanford School of Public Policy who runs its data brokerage project and oversaw the report, said other entities that store health data, including most phone apps, aren’t regulated through HIPAA, leaving data brokers with a number of options to legally purchase such data.