HCA Healthcare says the breach affected patients from 20 states. The breach included details, names, telephone numbers, and appointment times.