Intrusion at US healthcare software provider puts 3.8M people's data at risk