OSF notifies patients of vendor security breach