HCA believes that clinical and financial information were not included in the theft which possibly impacted 11 million patients in 20 states.