Not just "able to". For standards compliance, you're required to use either & or one of the equivalent numerical entities whenever you want an ampersand literal to appear in HTML, whether it's in an attribute value or in the body of the text.
Most web browsers will silently turn improper ampersands into literals for you because so many web developers get it wrong so frequently (which ironically contributes to more and more developers getting it wrong), but it's still wrong.
It would probably be a good idea to run xmllint on your content. It's a great tool for catching these sorts of mistakes, and IIRC would have flagged that as an invalid entity.