The question is who stores the data. If you manage to let the patients keep it locally or in physical media it's insane. If you are keeping it for them it's the same worries as any other service.

This was not journals though, but calls to nurses.

We store data for you in a way that's considerably more secure and paranoid than how other providers work -- quite similarly to CryptDB. We can access your data when serving it to you, but your medical data is never stored on disk with a key that we store (it's derived from your password, and we throw it away after serving you through HTTP).

More would be solved with simply the ability to, on a simple request and without justification, delete all data associated with yourself. Including all shared copies.