A hack of health-care data involving a medical bill collector and two major diagnostics companies has grown to almost 20 million people, and is now attracting more questions from a key member of Congress.

American Medical Collection Agency, an Elmsford, N.Y.-based collections firm, has now been identified by two large medical companies as the victim of the latest large health-care data breach. On June 4, Laboratory Corporation of America Holdings said that 7.7 million patients’ accounts at AMCA were stored in the vulnerable computer system. The disclosure follows a similar warning by Quest Diagnostics Inc. that 11.9 million people were...