GDPR only applies to processing of personal data. Anonymized data no longer is personal data. A more important question is whether the data was anonymized in the sense of the GDPR. It would still be personal data if it was merely pseudonymized. The difference is whether a key exists that allows the data subjects to be reidentified.
If the medical data is personal data, it might fall under special categories of data where processing is restricted. Possibly, processing for the purpose of research would require consent. This is the kind of stuff where a company might want to ask their in-house counsel for advice, and may have to confer with their supervision authority.
GDPR does not consider the location or origin of personal data, except for controller → non-EU country data transfers. Receiving/collecting data from outside the EU has no additional restrictions and the same considerations apply as if the data was collected within the EU.
If the controller's processing is subject to the GDPR (e.g. because the controller is established in the EU and dealing with personal data) then yes, international transfers do require extra care.