HCA reports cybersecurity incident exposed data of 11 million patients

Nashville-based HCA Healthcare, one of the country’s largest hospital operators, announced a data breach on Monday that exposed the personal data of about 11 million patients across 20 states.

The data breach is one of the largest at a healthcare system this year. Personal patient data including names, addresses, phone numbers, dates of birth, and gender was stolen from an “external storage location” used to automatically format emails, and then posted in an online forum, according to HCA. The exposed data didn’t include sensitive information such as medical records, payment information, or Social Security numbers, the system claims.

“There has been no disruption to the care and services HCA Healthcare provides to patients and communities. This incident has not caused any disruption to the day-to-day operations of HCA Healthcare,” according to the system. “Based on the information known at this time, the company does not believe the incident will materially impact its business, operations, or financial results.”

More healthcare organizations are experiencing cybersecurity incidents such as ransomware attacks, which are becoming increasingly more expensive. A ransomware attack at Chicago-based CommonSpirit Health in 2022 cost the health system approximately $160 million in damages, with many of the costs coming from incident response and notifying affected patients of the data breach.

HCA will provide “credit monitoring and identity protection services, where appropriate.”

“While our investigation is ongoing, the company has not identified evidence of any malicious activity on HCA Healthcare networks or systems related to this incident,” according to HCA’s statement.

HCA operates 180 hospitals and ~2,300 ambulatory sites of care across 20 states as well as the United Kingdom, and has approximately 37 million patient encounters each year.