"Could be paying out",indeed . It's doubtful whether the BBC or the NHS are vicariously liable, as a matter of strict law. The courts, being pragmatic and eager to stretch a point to ensure claimants are compensated, are quite keen to nail anyone with vicarious liability if the tortfeasor, the wrongdoer, has not got funds to meet claims and the other potential defendant has plenty of funds, but Savile's estate is quite well funded. Therefore claimants should look there first and would be encouraged to do so.
On what basis is the NHS liable? If it knew perfectly well that Savile was committing sexual offences yet did nothing,yes, it could be. The same applies to the BBC, though, given what we now read, it might be easier to establish a wilful 'blind eye' in the BBC's case. Otherwise not; it might be said that Savile's engagement to work for the BBC was akin to an employer -employee relationship, but even employers are not liable for everything done by an employee. If my employee runs over someone, on an errand in his work, I am liable. If he murders or rapes someone, I am not.