but it's not even ransom, "ransom" is the situation where something/someone is held until money is payed and then it's returned.

There is nothing being returned here, since the hospital has not lost access to the data, and the threat is that private data will be published.

This is just blackmail.