It is the third-largest breach of health information reported in 2017 in terms of the number of patients affected, according to the Department of Health and Human Services Office for Civil Rights, which tracks hacking incidents of health systems affecting 500 or more people.