The claims administrator allegedly shared records for tens of thousands of patients’ with unlicensed overseas entities.