You don't need full SGX if you trust the provider.

People already trust providers with their medical data. Why not trust some computation service to do the matching? This is a moment for trustworthy institutions to create data centers and get customers by their reputation.

Combine a big market of trustworthy providers and SGX, and abuse becomes much more difficult.