I think breaches like this are the reason that there's been more of a focus on creating 'trusted research environments' lately, rather than actually transferring data out of the healthcare system.

There was a really interesting review recently by Prof. Ben Goldacre which touches on a lot of this stuff, I recommend skimming it: https://www.goldacrereview.org/