Setting aside that you could just read Jesse's article and see the screenshots of the spreadsheet and answer these questions

I did read the article. The article doesn't address these in full. The only implication is she blocked out names and contact details using a black text box, but that's not PHI removal. There is no mention of which replicable process was used to remove PHI, nor is every variable from the sheet noted.

But again, because you and others seemingly have a very hard time with comprehension - I've very explicitly said I have no place to make any claims on the legal issue. Just that as a social science researcher who has dealt with these issues before (i.e. potential staff misconduct), I have never been in an institution or organization where the way she handled data would be deemed acceptable. Take that for what you will. If you think she behaved ethically, knock yourself out champ.