ICO should step in.
Any patients asking for copies of their own records wouldn't have been able to be given complete sets due to this missing data sitting at the SBS but nobody would have known that other than the SBS.
They have fundamentally failed to care for the data in their possession whilst data controllers.