5,400 patients’ personal information may have been exposed after hospital computers were infected with a virus.