Regulator says stranger entered hospital, treated a patient, took a document ... then vanished