Why would you even keep these on anything but archive media??
I did some IT work for a plastic surgery practice in the US many years ago. I was adding some storage to an existing server. I was shocked to see that the practice was keeping all their before / after photos online going back years. Not encrypted. Hanging out in Windows file shares with lax permissions.
It certainly gave me pause.
Maybe some software providers in this space will think about handling this better.
In contast, anything more secure tends to add inherent friction (since just blindly giving access due to some potentially replayed hash of a user's likely weak password isn't exactly going to be appropriate in a secure setup). And if it adds complexity, people still go for the old solution.
I hope they had backups - I've often caught out the same Windows SMB-using orgs out when checking their backups and discovering both of their weekly-cycled drives are empty and devoid of backups, despite having been diligently swapped out according to the schedule!
A plastic surgeon might want to look at before-and-after for a few of their "branches" (specific plastic surgeries or repeated applications of a technique). "When I did celebrity-A I notice they sag too much in location-X, whereas for celebrity-B where I changed the procedure location-X looks much better." "Celebrity-P has the same odd nose Celebrity-K had ... let me consult my notes and the before/after for Celebrity-K."
The only place I can't get away with it is a dentist. They love giving x-rays...because apparently that helps with scaling.
(which isn't to say that they'd purposefully choose two different implementations. Rather, just that if i'm using poor person doctors i'm unsure they'd rise to the new "standard" of security practices)
But they simply don't care.
In the past before computers they would be putting these in files on a large file folder shelving units with colored folder tabs behind a counter and the only real security was a receptionist that would stop you if you tried to interact with it, and they locked the door to the office when they left. If someone broke into the office back then too, your medical records would've been stolen & unencrypted (beyond the illegibility of most doctor's handwriting) and as a society, we were ok with that security level.
Harsh fines are probably the best way to make doctors care though. If they know they risk financial ruin for not securing their records, they'll have a strong personal incentive to remediate their ignorance.
For all you know, they could have had that system too, the article does not say what it was.
BD-R (except LTH) use an inorganic layer to record on.
Now they should be doing 3-2-1 backups. With S3 they'd be paying $160/month (for storage, not counting other costs) for 8TB or $40/month for BackBlaze B2. That's 8,000 customers.
They're in England so some variance in pricing. But it would be relatively inexpensive to buy big drives, sync them to a set in the office, and back them up online. Where the doctors or whoever is running the clinics can SEE the data is still there whenever they want.
I agree that there should be increasing worry about keeping information that you don't need, whether it's intimate pictures of your surgical clients or people who bought from you 5 years ago and not since. But it seems like keeping things handy will be an impulse that's hard to overcome.
(Although I'd hope they obscure identifying details and get permission from the original patients...)