Most of the HIPAA restrictions can be waived by the patient, i.e. you can contract around it, so it's really more about contractual defaults and consent than censorship.

But that's obviously still a slippery slope. You get the same sort of scenario with classified documents which are at the same time evidence of government misconduct. Everyone with access to the documents agreed not to disclose them, which means there is no one who can reveal the misconduct to the public without violating that agreement.