Medical records are frequent targets because they contain a rich tapestry of information that can be used for identity theft. (Photo: Getty)

A hack of health-care data involving a medical bill collector and two major diagnostics companies has grown to almost 20 million people, and is now attracting more questions from key members of Congress.

American Medical Collection Agency, an Elmsford, New York-based collections firm, has now been identified by two large medical companies as the victim in a large health-care data breach. On Tuesday, Laboratory Corporation of America Holdings said that 7.7 million patients' accounts at AMCA were stored in the vulnerable computer system. The disclosure follows a similar warning by Quest Diagnostics Inc. that 11.9 million people were exposed.

Related: How to reduce cybersecurity risk to employees' health data