Compromised information could have included address, age, medical record number, diagnosis or other treatment information.