A system for anonymizing and aggregating protected information, PI, from a plurality of data sources, the system comprising: a master index server coupled to a data repository, configured to receive an anonymized record associated with an individual from a plurality of data hashing appliances and to store the received record to the data repository; a cluster matching engine operatively coupled to the master index server and the data repository configured to apply a plurality of rules to hashed data elements of the received anonymized record for comparing hashed data elements of the received anonymized record with hashed data elements of a plurality of clusters of anonymized records stored in the data repository, each record in a given cluster of anonymized records having been previously determined to be associated with a same individual and being associated with a unique cluster identifier, to determine whether the individual associated with the received anonymized record corresponds to an individual associated with one of the clusters of anonymized records; when the received anonymized record is determined to correspond to the individual associated with one of the anonymized cluster of records stored in the data repository, the cluster matching engine is configured to add the received anonymized record to the one anonymized cluster of records associated with that individual; wherein each of the plurality of data hashing appliances is operatively coupled to a respective data source and is configured to receive from the respective data source one or more patient medical records associated with an individual, each record containing at least one data element corresponding to confidential protected information, PI, and a master record number, MRN, assigned by the respective data source, wherein each data hashing appliance is configured to: append a salt value to each data element corresponding to confidential PI in a patient medical record; generate a hash value for each data element corresponding to salted confidential PI; replace the data element corresponding to confidential PI with the corresponding generated hash value to generate an anonymized record; and wherein each data element corresponding to confidential PI is processed using a first hash algorithm to generate a first hash value; each first hash value is processed using a second hash algorithm to generate a second hash value, the resulting anonymized data record; each first hash value is destroyed; and each data element corresponding to confidential PI in the patient medical record is replaced by the corresponding second hash value, such that the corresponding second hash value cannot be decoded so as to identify the value of the original data element corresponding to confidential PI. a master index server coupled to a data repository, configured to receive an anonymized record associated with an individual from a plurality of data hashing appliances and to store the received record to the data repository; a cluster matching engine operatively coupled to the master index server and the data repository configured to apply a plurality of rules to hashed data elements of the received anonymized record for comparing hashed data elements of the received anonymized record with hashed data elements of a plurality of clusters of anonymized records stored in the data repository, each record in a given cluster of anonymized records having been previously determined to be associated with a same individual and being associated with a unique cluster identifier, to determine whether the individual associated with the received anonymized record corresponds to an individual associated with one of the clusters of anonymized records; when the received anonymized record is determined to correspond to the individual associated with one of the anonymized cluster of records stored in the data repository, the cluster matching engine is configured to add the received anonymized record to the one anonymized cluster of records associated with that individual; wherein each of the plurality of data hashing appliances is operatively coupled to a respective data source and is configured to receive from the respective data source one or more patient medical records associated with an individual, each record containing at least one data element corresponding to confidential protected information, PI, and a master record number, MRN, assigned by the respective data source, wherein each data hashing appliance is configured to: append a salt value to each data element corresponding to confidential PI in a patient medical record; generate a hash value for each data element corresponding to salted confidential PI; replace the data element corresponding to confidential PI with the corresponding generated hash value to generate an anonymized record; and append a salt value to each data element corresponding to confidential PI in a patient medical record; generate a hash value for each data element corresponding to salted confidential PI; replace the data element corresponding to confidential PI with the corresponding generated hash value to generate an anonymized record; and each first hash value is processed using a second hash algorithm to generate a second hash value, the resulting anonymized data record; each first hash value is destroyed; and each data element corresponding to confidential PI in the patient medical record is replaced by the corresponding second hash value, such that the corresponding second hash value cannot be decoded so as to identify the value of the original data element corresponding to confidential PI.