A healthcare firm has disclosed a major cybersecurity incident that may have exposed the personally identifying and personal health data of tens of thousands of Americans.