On a notebook (the paper kind), locked, in a specific doctor's office is not a problem at all.
That's the kind of damage leaks like this do.
Sure, send the patient data over an unencrypted phone line, probably using a never-updated smart scanner to an internet-connected IoT-printer. Sounds like a plan!