The ethical permissibility of mandating the contribution of medical records to government-managed research databases—without individual consent—has provoked significant debate, particularly regarding the potential violation of moral privacy rights. This paper offers a qualified moral defence of such mandatory contribution by differentiating between privacy interests and privacy rights. Focusing on scenarios where only de-identified medical data is made available within highly secure Trusted Research Environments (Data Safe Havens), the argument proceeds in two steps. First, drawing on recent philosophical accounts of personal information, I contend that de-identified medical records, in themselves, do not constitute personal information and only become privacy-relevant when linked with additional identifying data—a condition precluded by Safe Haven protocols. Second, I assess whether the imposition of privacy risk (i.e., the chance of re-identification following a potential data breach) constitutes a violation of privacy rights, employing normic, probabilistic, and modal accounts of risk. I argue that, given industry-standard security measures, the risk posed does not meet the threshold for rights-violation by any major philosophical standard. While mandatory contribution might infringe on privacy interests, it does not violate privacy rights under these stringent conditions. The analysis elucidates that, absent a rights-violation, a utilitarian harm-benefit assessment suffices for ethical justification. Nonetheless, the broader moral acceptability of mandatory contribution depends on addressing concerns of public trust, potential misuse, and equitable benefit distribution. The paper concludes by emphasising the need for robust oversight and further ethical analysis to ensure the ethical legitimacy of health data research.