HCA Healthcare says data of 11m patients in 20 states may have been stolen