Comment by linker3000

Yes, however in the UK and EU the patient is the Data Subject and has legal rights on what processing is done with the data about them.