It shows its preference for the more flexible common law «reasonable expectation of privacy» rule, which defines what (information) is and is not amenable to privacy protection based on what ought to be expected in a democratic society and in the full factual context.
It is, it seems to me, impossible to construe that agreement in its true factualcontext as providing full compensation for the loss which is claimed against the hospital.