Private hospitals and consultant are threatened with legal action over poor data compliance