An unauthorized user accessed certain systems between late November and mid-February, the health system said in a March 24 notice.