The breach, impacting nearly 20,000 people, affected the data of two health care clients subject to HIPAA, according to the Am Law 200 firm.