Four million patients could be affected by medical info stolen from a Chicago-based medical group