I'm not an expert and I know that a healthcare system requires the handling of personal data. While this data might end up aggregated at some level, I'm not entirely sure that a registry like this is required to exist in the first place.

For me it looks far too sensitive to have it as one central database. (... all assuming that it wasn't compiled by those who leaked it.)

edit: "sensible" doesn't actually mean what I thought it does. Replaced it with "sensitive".