The Nemadji Research Corp., a patient eligibility and billing service based in Minnesota, announced that the protected health information of thousands of patients may have been exposed earlier this year after a Nemadji employee fell victim to a phishing attack.