In response to your suggestion on data being made available, there are often issues of proprietary datasets that cannot be made public (for legal or ownership reasons). It is a frustrating situation, but one that is not likely to change anytime soon, so I would be happy with just the open-access publication requirement.
One year can also be extremely low w.r.t. a privacy viewpoint. Even assuming that anonymization is possible, a) who would pay for it? and b) it could make it impossible to verify the research (there are a lot of 'describe one patient' papers out there)
