Safeguarding customers' property, that may include personal data, is not only obligatory but a requirement of any Quality Management System under ISO 9001. I guess most hospitals are certified in UK. This is a clear non-conformity if this hospital claims to be a certified one.