They seek information about why it took two months to notify Congress about the incident, which exposed the data of 254,000 Medicare beneficiaries.