4.5 million affected in hospital data breach