Nice to know that this company protects their commercial intellectual property better than patient data. That's how you tell a company is going places!
And screw them saying they didn't put people at risk. A SSN and the other bits will be as good as anything for stealing some identities. An outdated number will still be listed in everyone's records everywhere else, so getting a new number won't protect well against fraudsters. But I'm sure the company has no plans to voluntarily compensate people, that would be taking responsibility and these clowns proved they don't have the balls for that.