Whether the person or persons lost their jobs and are now unemployable is irrelevant. The London Clinic and ICO both laughably claim that this "sad incident" has been appropriately dealt with, and there's insufficient evidence to support a prosecution. Of course they don't want a trial.
This report is different, and says they succeeded and tried to sell the information. So it's out there.
The media reports very (and the initial DM report varied on the same page).
The actual ICO statement is here
cy.ico.org.uk
It only refers to 'deliberate misuse' of the information (which could be include attempting to access or succeeding) and an 'offer to disclose'.
It also says that '
the ICO issued a now former healthcare professional from London with a formal caution in relation to an offence under section 170(5) of the Data Protection Act 2018'.
The legislation is here for anyone interested
https://www.legislation.gov.uk/ukpga/2018/12/section/170
The ICO has the same powers as the police and CPS here. A caution means that the person has admitted they have committed the crime and now has a criminal record. It will be disclosed on any checks needed for professional jobs.
It is only used for relatively minor crimes, so it is likely that the person was detected before they were successful. Another thing that makes this likely is that the issue was referred to the ICO by the London Clinic themselves - so they probably detected the attempt electronically.
There may be many reasons for the delay. One obvious one is that it is likely that there were professional misconduct proceedings happening in parallel.