Patients’ names, addresses, phone numbers, birthdates, insurance information and medical information may have been exposed.