Doesn't this mean that it's not only your hospital that sees your medical records, but... everyone who would otherwise only need your name and telephone number?

Or is there some way to restrict which party gets which data?