I don't know much about HIPAA and medical privacy, but I do know it only aplies in the US, and (I think) you can sign your way out of it. However, that said there would still be a bunch of concerns, involving who has access to what.

I mean just get them to sign it away with a disclaimer that says 'i release this data under a creative commons licence' and host it somewhere that HIPAA doesn't apply