Hospital bank loans leave patients vulnerable