A cyber security expert says doctors’ personal information and identity documents could be sold on the dark web or used to “buy or prescribe” drugs.