Index: profile.module
===================================================================
--- profile.module	(revision 13)
+++ profile.module	(working copy)
@@ -413,6 +413,11 @@
        drupal_access_denied();
        return;
     }
+    // Do not allow browsing browsing of hidden field.
+    if ($field->visibility == PROFILE_HIDDEN) {
+       drupal_access_denied();
+       return;
+    }
 
     // Compile a list of fields to show.
     $fields = array();