The liability of holding this information on local hard drives far outweighs any benefit. The people who's information has been breached can be blackmailed, fired, divorced or worse when this information goes to those in their communities. The class actions will cost American companies, many of which have had the same problem and not let it hit the news, billions.
Health service providers are notoriously cavalier in the security of data and in HIPAA practices. Data security is everything here, and they's better take notice.