The MVP for that system wouldn't be all patient data, it'd be just one metric or something that you could harden the system's other properties against. If you leak one metric, you probably leak them all (and the inverse is probably true). The training costs are amortized because they are dominated by one-time costs of learning the system for one metric, not all metrics.