A consent from a subject is not the only means to lawfully process the data.
In your case, it's the hospital that is required to demonstrate the lawful basis of processing and consent.
Specifically, Rec.46; Art.6(1)(d) states that processing is permitted if it is necessary in order to protect the vital interests of the data subject or of another natural person.
Article 6 of the GDPR describes other lawful basis for processing.