HIPAA is about not identifying the patient. It doesn't say you can't take 100M mammograms, wipe out the PII, and add "this image is of a patient that disease X". I'm not sure how much other demographically interesting metadata you can add, like age, gender, height/weight, etc.