The computers that store patient records (which were compromised) are not medical devices under any regulatory regime I know of.

And in any case the compromises were in the UK, which may have different rules on this subject than the FDA.