Does the HIB apply to non-digital systems like pen-and-paper setups?

Yes, even clinics using pen-and-paper systems are required to comply with HIB guidelines, as data protection requirements apply universally.