It needs to be a system and a contractual framework that complies with the medical privacy regulations of the place where it's being used (in the US, HIPAA). I have some doubts about whether specific companies or people will actually comply, or the enforcement of those laws by certain governmental authorities, but I don't think it's conceptually impossible to have this kind of tech be compliant with those types of regulations.