Federal health officials are allowing hospitals and clinics to require UnitedHealth notify patients if their data was exposed in that massive cyber attack on the insurer's payments unit back in February.