The part about passwords and password recovery is a bit troublesome in my opinion. If I am unconscious when I am brought to the hospital, the doctor should be able to access my records or release them to another doctor. Someone showing early signs of dementia might throw out their token and have no memory of ever having a password -- what do you do then? The threat is that an attacker might dump a database or steal a hard drive, not that a doctor might attack from the inside; doctors need to be able to access patient data under a variety of circumstances, including those where a patient is unable to give their consent or present a special token.

I think a better solution would be to give each doctor a smartcard, and to require some sort of threshold signature for certain operations (like sending patient data outside the hospital network) so that no single doctor has all the power. Attribute based encryption comes to mind here, since the ciphertext should only be stored once but should allow any doctor to decrypt; nurses might also need some amount of decryption capability (and would then need a smartcard of their own). Giving patients full control over their records sounds great on paper, but in practice people will forget their passwords and lose their tokens, and will probably not even realize the token is lost until they actually need medical care (and then it is too late).