'Hacker' threatens to expose health data, demands $10M