Because patients should have the right to decide whether and where their confidential medical data is stored.
I'm not arguing against the sentiment (and indeed I think patients should have a much stronger ability to audit and control how their records are shared, including the ability to opt out of sharing) -- but when it comes to records retention by the originating organization, it's important to evaluate these practices in the broader context.