I'd also assume the worst, even if there are no patient names out. There are too many examples of de-anonymization of purposefully anonymized data out there to warrant any belief that missing real world names alone should constitute much of a privacy blanket.
The dataset in question supposedly contains date of birth, gender and post code. For my family, that uniquely identifies every member, given the size of UK post codes.
If that means full postcodes, then that information will easily be sufficient to identify every member of the UK population, aside from outliers like twins or the occasional statistical fluke.
"No individuals directly named records online. But a massive breach of the most basic information security policies to prevent jigsaw."
https://twitter.com/bengoldacre/status/440488463008550912