9 million patient records exposed in major us medical data breach