Yes, however in the UK and EU the patient is the Data Subject and has legal rights on what processing is done with the data about them.
I thought you may mean that the legal rights provide protection, so one need not worry until deidentification or detachment. Maybe your emphasis was same.
But for clarity, I think we need to worry long before deidentification and detachment — basically the Trusts are not to be trusted, and our legal rights will vanish in a heartbeat.