Patients’ names, genders, medical record numbers, birthdates and dates and times of service may have been exposed.