The breaches included one incident in which a hospital department that deals with sexually transmitted infections “inadvertently” sent a text message containing a patient’s personal and health data to a third party.