1,039 patients’ personal information may have been exposed when an unencrypted thumb drive was lost.