From the article: "And what they uploaded was the entire shooting match—full personal medical records indexed by NHS patient number—with enough additional data

From the article: "And what they uploaded was the entire shooting match—full personal medical records indexed by NHS patient number—with enough additional data (post code, address, date of birth, gender) to make de-anonymizing the records trivial." So I'm guessing that they are not properly scrubbed.