HIPAA is a US law that's focused on protecting the privacy of a person's medical history. In SQL terms you can't JOIN a person's identity with their medical history (unless explicitly authorized). However aggregated data is allowed, as long as it can't be easily reverse-engineered.
You acknowledge that HIPAA doesn’t allow identifying specific patients. Are you under the impression that she named a identified a specific person in that article?
HIPAA is a US law that's focused on protecting the privacy of a person's medical history. In SQL terms you can't JOIN a person's identity with their medical history (unless explicitly authorized). However aggregated data is allowed, as long as it can't be easily reverse-engineered.