If you're in the US, make sure the data set complies to HIPAA. Double check to make sure you don't have any information that would allow identification.
Another one measure that HIPAA may not touch on is the rarity of the medical outcome(s) in your data set. Participants in a flu data set are a lot harder to identify that participants in, say, an anthrax poisoning data set. You'd need to check on the definition of what constitutes a rare outcome.
Ultimately, you should seek advices and support from these following agencies: 1) your own institutional review board (IRB), 2) the funding agency that supports your work, and 3) the original owner of the medical records who allowed you to extract the retrospective data. If all these three are okay, it's very likely to be fine. If anything hits the fan, showing evidence that they had granted you support and you have done your due diligence in safeguarding the privacy of the data would do you a lot of good on legal ground.
Additionally, even for reproducibility, you don't necessarily have to make the data set available to everyone. With some work on your side you can set up a data user agreement mechanism, so that at least you can have some track records on who borrowed the data and for what reason. If you explain to the journal that any of the three agencies above prohibits free access, the editor will usually understand and agree with the data user agreement routine.