Some pretend to be hospitals to get patients’ payment data. Others pose as the government and try to get confidential data from hospitals.