A healthcare company that operates hospitals and clinics in 20 states says hackers stole personal information for more than 11 million patients.

HCA Healthcare says the stolen data includes names, addresses, emails, and appointment dates – but does not include clinical information, credit card numbers, or other sensitive data like passwords.