Do either of you have an off-site box he can ssh into? If so, connect from
his computer with ssh configured as a SOCKS proxy, then configure his
browser to use the local ssh proxy.

He'll be limited by both the hospital's speeds, as well as the up- and
down-link speeds of the remote computer, but it may be better than nothing.
YouTube may be intolerable, but basic web sites should work.

It's also possible the hospital's content filter will block the outbound ssh
traffic, in which case, good for them for having it set up properly. Using a
non-default port for ssh may improve odds of success. The only way to know
for sure is to test.

I'm not sure what the legal ramifications are. He may have signed onto an
acceptable use policy and be liable if he breaks it. I'm no lawyer.