Third-party data breaches, unauthorized email access cause PHI exposure