Unlike a stolen card, sensitive patient data cannot be replaced. Once exposed, it follows patients for the rest of their lives.