Individuals that donate any medically related items (records, pill bottles, etc.) to a museum are giving up their right to privacy, unless they specify some disclosure clause during the acquisition process.
This would be similar to someone posting their medical history with pictures of pill bottles on Facebook.
Just be certain that the (patient) donors understand the consequences. However, doctors, pharmacists, psychologist all have obligations to protect health information. Not only is it a privacy issue, but disclosures could lead to medical fraud, with serious health or financial consequences to the individual.
I know this sounds dire, but cracking down on medical fraud is a very high priority of the OCR, as is HIPAA violations.