HCA Healthcare Data Breach Impacts Patients and Employees

HCA Healthcare Inc, a for-profit healthcare provider based in Nashville, Tennessee, reported a data breach that was discovered in August 2026.

The breach was disclosed to the attorneys general offices of Texas and Massachusetts starting on Oct. 30, 2026. HCA Healthcare plans to begin notifying affected individuals by mail on Nov. 2, 2026.

The total number of affected individuals nationwide has not been disclosed, although at least 15,096 Texas residents were impacted.

On Aug. 12, 2026, HCA Healthcare identified suspicious activity involving certain of its IT systems. A subsequent investigation found that an unknown unauthorized party gained access to HCA Healthcare's systems on that same date and obtained copies of certain files containing personal information.

The breach affected two separate groups of people. The first group was medical resident employees whose Human Resources files were accessed. These files contained employment-related information the medical residents had provided to HCA Healthcare.

The second group was patients who had received care at one or more HCA Healthcare-affiliated facilities or physician offices. The files that were accessed contained personal information these patients had provided when receiving care.

For medical resident employees, the exposed information included names, Social Security numbers, dates of birth, contact information, personal email addresses, phone numbers and immigration information where applicable.

For patients, the information could include names, Social Security numbers, dates of birth, contact information, personal email addresses, phone numbers, medical information and health insurance information.

HCA Healthcare's response to the breach

The company is offering two years of complimentary identity theft protection services through IDX, which it described as a data breach and recovery services expert.

Affected individuals who wish to enroll will need the enrollment code included in their notification letter. Enrollment is available by visiting the IDX enrollment page or by scanning a QR code included in the letter. The enrollment deadline is Feb. 2, 2027.

HCA Healthcare also set up a dedicated call center to help affected individuals with questions about the breach or the identity protection services. The call center can be reached at 1-866-200-0915 and is available Monday through Friday from 8 a.m. to 8 p.m. Central Time, excluding holidays.