The data breach was discovered June 1, a day after an employee received a phishing email to compromise the account and an unauthorized person received access to files that included personal health information of the 8,000 patients.