I second colindaven 's suggestion. If the patients did not provide full (and expansive) written consent then you cannot share their raw genomic data without undertaking significant legal liability not to mention academic misconduct etc...
You can however published agglomerated data (gene counts, etc...) which should be sufficient for most purposes.
Otherwise you should submit the data to a controlled database:
US: https://dbgap.ncbi.nlm.nih.gov/ EU: https://ega-archive.org/
It a bit of a slow process and you likely need your uni/institute to put together a data-access committee etc... I think for the revisions you could state that you have initiated the process and that would likely be sufficient.
Here is some information about this from DHHS: https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html
https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#rationale section clearly defines what can be done with such information and a standard https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#standard.
Please clarify what kind of data are you are referring to? Many of the posts below are assuming some sort of sequence data (which may not be the case). This is important information that needs to be stated in original post.