Clients’ names, birthdates, treatment records, and health and clinical histories may have been exposed.