It depends on the medical knowledge.
They could have potentially also have got into commercially sensitive info. Possibly patients financial information.
The big one is people’s PPS. They are valuable all public systems are linked to them, revenue, social welfare, driving licence.
Depending on how far they got in that could be both staff and patients.
Patients could have private info they are choosing not to reveal, ie HIV, TB, an abortion springs to mind straight away.
It is absolute carnage.