The complaint alleges the EHR provider failed to follow guidelines for protecting data after the company said compromised credentials enabled unauthorized access to the confidential information of more than 1 million people.