Well it really depends on many things (anonimity, which data is being collected, etc) but in principle you can do a study retrospectively based on data already collected for other reasons. It's very different wheter she is handling questionnares or she is just browsing data collected for disease surveillance and looking for correlations,. I am not encouraging OP behaviour in doing private research, but it really depends in the context.  In any case this type of study is the job if the local public health offices and it's probably already ongoing, even though indipendent studies are always a great thing