HCA Healthcare hcahealthcare.com HCA Healthcare data breach: what happened and what to do
In July 2023, HCA Healthcare said a list of patient data was posted online. HHS counts about 11.27 million people. Names, contact details, dates of birth and appointment details were involved. HCA says clinical and payment data and Social Security numbers were not.
View all 13,115 breaches- Breach date
- 29 Jun 2023
- Made public
- 10 Jul 2023
- Affected
- 11,270,000
- Data exposed
- Names, Physical addresses, Email addresses, Phone numbers, Dates of birth, Genders, Appointment details
- Last updated
What happened
On July 10, 2023, HCA Healthcare, one of the largest hospital operators in the US, announced that an unknown party had posted a list of patient information on an online forum. HCA said the data came from an external storage location that it used only to format emails sent to patients. The company reported the incident to law enforcement and brought in outside forensic specialists.
The U.S. Department of Health and Human Services lists the breach as affecting 11,270,000 people. HCA's own announcement put the figure at about 11 million patients across 20 states.
What was exposed
According to HCA's notice, the data included patient names, the city, state and ZIP code of their address, email addresses, phone numbers, dates of birth and gender. It also included the date and location of past services and the date of a next appointment.
HCA says the files did not contain clinical information such as treatment, diagnosis or condition, payment information such as card or account numbers, or sensitive details such as passwords, driver's license numbers or Social Security numbers.
That still leaves enough for convincing scams. An email or text that knows your name, your hospital and your appointment date looks real. Expect messages pretending to be from the hospital, billing or insurance, asking you to confirm details or pay a bill.
HCA's response
HCA emailed affected patients and mailed notification letters in August 2023, state by state. It offered 2 years of free credit monitoring and identity protection through IDX and set up a call center. The company says it will never ask for sensitive information by phone or email.
What to do if you were in it
- 1
Treat messages that mention your hospital visit with suspicion
Scammers can quote your name and appointment date. Don't click links or call numbers in an unexpected email or text about a bill, a refund or an appointment. Find the hospital's number on its website and call that.
- 2
Never give out codes or card details to an incoming caller
HCA says it will not ask for sensitive information by phone or email. Anyone who does, even with accurate details about your visit, is not the hospital.
- 3
Take the free credit monitoring if you got a letter
HCA offered 2 years of monitoring through IDX. Your Social Security number was not part of this data, but monitoring costs nothing and catches new accounts.
- 4
Read your insurance statements
Check explanation of benefits statements for visits or services you don't recognize, and report anything odd to your insurer.
- 5
Check whether your email or phone number shows up in this and other breaches
Serus runs a free scan that checks your email and phone number against known breaches and the dark web, and alerts you when something new appears. It can't remove breach data, but it tells you what's out there so you know what to act on.
Frequently asked
Was I affected by the HCA Healthcare breach?
If you were an HCA patient, you may have received an email in July 2023 or a letter in August 2023. If you didn't get either and think you were a patient, contact HCA through hcahealthcare.com/privacyupdate.
Were Social Security numbers or medical records exposed?
HCA says no. It says the data didn't include clinical information, payment information, passwords, driver's license numbers or Social Security numbers.
How many people were affected?
HHS lists 11,270,000 people. HCA's announcement said about 11 million patients.
Should I change my password?
Passwords weren't in the data, so there's nothing to reset because of this breach. Do watch for phishing that uses your name and appointment details.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
