Medical images play a crucial role in doctors' clinical diagnosis and treatment. However, the transmission and sharing of such private information raises security concerns. To address this issue, image hiding is used as an effective technique to protect images. To achieve large hiding capacity, lossless recovery and anti-steganalysis, we propose a novel two-stage medical image-hiding method in this paper. In the first stage, a QR code for the patient diagnosis information (PDI) is generated and embedded into a secret medical image using reversible data hiding. In the second stage, the secret medical image containing PDI is hidden in a natural target image. A kind of lossless compression technique named soft compression is innovatively introduced in two hiding stages, to ensure that the reconstructed secret medical image and PDI are exactly identical to the original ones. Moreover, an adaptiven-LSB model is proposed to improve the stego image quality. Extensive experimental results show that our method achieves a PSNR of over 40dB for the stego image at 2 BPP while recovering the PDI and secret medical image with 100% accuracy on the DIV2K, COCO and ImageNet datasets. It outperforms other state-of-the-art methods in terms of hiding invisibility, recovery accuracy and security.