The files the hacker accessed included personal health information, such as date of birth, address, medical record number, hospital account number, admission diagnosis, and date(s) and time(s) of service. The information accessed did not include credit card information, bank account information, or usernames or passwords.