The Data Protection Commission found the system ‘risked unauthorised access to sensitive medical information’