I don't believe this is a police matter. You should first make a direct complaint to the hospital. If you do not get a response within 30 days, you should contact the Office of the Australian Information Commissioner (OAIC) with a complaint and they will investigate.