The media upload of files is publicly available. Even though the link is not necessarily easy to guess, the data is still publicly available and presents a flaw on data protection. Enabling HIPAA compliance does not make any difference, the media items have no request for authentication when visiting a link to the uploaded file. All form fields should be treated as sensitive data, including file uploads. This is a security risk for anyone using the file upload form field to collect personal data in some way.