UChicago Medicine said it was notified last month of a cyber security incident that happened from July 5 to July 11 last year.
UChicago Medicine said that someone without authorization accessed information from Nationwide Recovery Services, Inc., a now former third-party vendor.
The vendor told UChicago Medicine it's not aware of any misuse of the personal information.
About 38,000 patients were exposed.
UChicago said it would provide a written letter to the latest mailing address to those who were affected.
The information exposed includes: first and last name, address, date of birth, Social Security number, financial account information, and/or medical-related information.
To learn more about UChicago Medicine's response to the security breach, click here.