The patients’ names, addresses, birthdates, medical record numbers, account numbers and health information may have been exposed.