So they need more data from healthy patients when they're healthy in order to determine what's anomalous?

SIEM tools do anomaly detection with lots of textual log data and sensor data.

What would a Cost-effectiveness analysis say about collecting data from healthy patients: https://en.wikipedia.org/wiki/Cost-effectiveness_analysis

TIL the ROC curve applies to medical tests.