F500 Healthcare Providers · Health Care: Medical Facilities · Data breach
HCA Healthcare
Headline
The 2023 HCA breach exposed data on roughly 11 million patients, and the mechanism is the part worth understanding: the stolen database was an external storage location used to automate email formatting - appointment…
The 2023 HCA breach exposed data on roughly 11 million patients, and the mechanism is the part worth understanding: the stolen database was an external storage location used to automate email formatting - appointment reminders and similar - not the clinical record system. So the exposure came from the marketing-adjacent plumbing rather than the medical vault, which is exactly the layer patients never think about and hospitals defend least. HCA is the largest for-profit hospital operator in the country, which means a single administrative-systems decision reached a patient population larger than most states.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. www.hipaajournal.com/hca-healthcare-cyberattack-data-breach-2023/ — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual patient agreements, separate from these two settled/pending matters.
Data sharing
TWO SEPARATE MAJOR FINDINGS: (1) A 2023 breach: hackers stole a database from an EXTERNAL STORAGE location HCA used to automate email formatting, exposing information for approximately 11.27 MILLION PATIENTS across HCA's 190+ hospitals and doctors' offices in 20 states — the stolen database reportedly contained about 27 million rows of data; when HCA did not pay the ransom, hackers listed it for sale. Class actions were filed and consolidated as Silvers v. HCA Healthcare, No. 3:23-cv-00684 (M.D. Tenn.); the settlement (reported at roughly $9.3 MILLION) received final court approval on Oct 29, 2025, offering up to $5,000 for documented losses plus 1 year of credit monitoring. (2) A SEPARATE, MORE RECENT putative class action (Doe et al. v. HCA Healthcare, Inc. and Urgent Care Enterprise, LLC d/b/a CareNow; filed June 11, 2026 in Davidson County Circuit Court, No. 26C1744; removed July 16, 2026 to M.D. Tenn., No. 3:26-cv-00993) alleges HCA's CareNow urgent-care subsidiary (20+ Middle Tennessee locations) shared patients' PROTECTED HEALTH INFORMATION with GOOGLE and other marketing/advertising companies via tracking technology embedded in its online appointment-scheduling platform — the SAME Meta/Google Pixel-in-healthcare pattern documented extensively for MyChart/Epic Systems elsewhere in this tracker, here alleged specifically to let Google 'exploit their health information for advertising purposes' by linking patients to their Google accounts.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. HCA suffered a breach in 2023. | fact | supported | none recorded |
| 2. The breach exposed data on roughly 11 million patients. | fact | supported | none recorded |
| 3. The stolen data came from an external storage location used to automate email formatting. | fact | supported | none recorded |
| 4. The emails were appointment reminders and similar. | fact | unsupported | none recorded |
| 5. The clinical record system was not involved. | fact | supported | none recorded |
| 6. The exposure came from marketing-adjacent plumbing, the layer patients never think about and hospitals defend least. | characterization | n/a | none recorded |
| 7. HCA is the largest for-profit hospital operator in the country. | fact | unsupported | none recorded |
| 8. A single administrative-systems decision reached a patient population larger than most states. | characterization | n/a | none recorded |
0 of 8 claims have a confirmed source of their own.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy hcahealthcare.com/util/privacy-notice.dot | Not fetched yet | NO (HTML only) |
| Terms of service hcahealthcare.com/util/terms-of-use.dot | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://www.hipaajournal.com/hca-healthcare-cyberattack-data-breach-2023/ Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.