Three US healthcare organisations are reportedly being held to ransom by a hacker who stole data on hundreds of thousands of patients.