Hacker reportedly selling personal and medical data of 655,000 patients