Correct me if I'm wrong, but it seems like the comment was a response not about proving that claim to be false (as the commenter pointed out there was no evidence either way), but rather the ethics of releasing data protected under HIPAA.