The hospital and clinic system went public with the breach on Friday but also said it first learned of impacts three weeks earlier.