What a dreadful waste of time and effort. The ward staff should be entering the data directly into system, not on sheets of paper which you then photocopy, and presumably subsequently securely destroy!
Whether you use either the 'Internet' or a local 'Intranet' makes no difference to a person determined to break into a system. At the turn of the millennium I worked with an 'ethical hacker' who was paid a very handsome salary to test, and improve, the security of our organisations worldwide systems. He usually managed to access secured data using methods not normally available to a general computer user, but he was determined that he could usually find a weak spot somewhere in most systems, even though they weren't connected to our system. The only secure system would be a free standing PC, with no connection to either the internet or an intranet (although this same person could also access data on laptops that were password protected, where he wasn't informed of the password!).