A California hospital notifies thousands of patients that their personal info was exposed