That doesn't seem to help anything. Wouldn't this be better:

> Personal data held by a hospital about their patients may not be used for any non-medical purpose, and may not be shared with any third parties unless directly necessary for a medical purpose.