Private medical facility outsources ‘destruction’ of patient files to family-run business that fails to do so, allowing confidential paperwork to leak.