It’s one of the thing where laws and audit can help a lot. Hospital (and lawyers) are supposed to secure their data. But nobody will care unless doctor loose their licence and hospital management get fired upon negligence with patient data.