Did the hospital release the records? Doubtful.
It almost doesn’t matter WHO leaked the records. The hospital is responsible for being sure they are secure. Could be, probably is, a very low level/low paid employee in, i.e., the medical records dept.