Bright medical office desk by a sunny window with an open silver laptop showing a simple blue chart and shield, a small red USB stick in the side port, a stethoscope, clipboard and ID badge

HCA Healthcare Data Breach: What Patients and Residents Should Do Now

RedKey USB

By RedKey USB. Published November 6, 2026. Facts about the incident come from HCA Healthcare's own notice and letters, state attorney general filings, The HIPAA Journal and Becker's Hospital Review. Identity protection steps come from HCA's letter and the FTC. All are linked in the sources. This is general information, not legal or medical advice.

Quick answer and key facts: the HCA data breach

  • What happened: HCA Healthcare says it identified suspicious activity on August 12, 2026, and that an unknown unauthorized party gained access via a third-party vendor that day and copied certain files containing personal information.[1]
  • Who is involved: medical residents, whose HR files included Social Security numbers, dates of birth and immigration information where applicable, and patients of certain HCA-affiliated facilities and physician offices.[2][3]
  • How many: HCA has not published a total. At least 15,096 Texans are affected, according to a Texas Attorney General filing, and the count is likely to rise as more state filings appear.[4][3][5]
  • What to do now: read your letter, enroll in the offered IDX protection by February 2, 2027, consider a credit freeze or fraud alert, and watch your Explanation of Benefits statements for medical identity theft.[2][6][7]
  • The longer-term lesson: old devices and paperwork that hold SSNs or medical files stay a risk. Wipe the copies you control properly before they are reused, sold or recycled.[8][9]

The HCA data breach puts two very different groups in the same position. HCA Healthcare says an attacker copied files holding patient information and human resources records for medical residents, and some of those files included Social Security numbers and immigration details. Notice letters are now going out. This guide sets out what HCA and state filings confirm, what affected patients and residents should do now, and why old devices and records that hold the same kind of information need a proper wipe.

What happened in the HCA data breach?

HCA Healthcare is based in Nashville, Tennessee. The HIPAA Journal describes it as the operator of 189 hospitals and approximately 2,600 ambulatory sites of care in 19 U.S. states.[3] In its substitute notice, HCA says that on August 12, 2026, it identified suspicious activity involving certain IT systems. It says it took steps to secure those systems, began an investigation with outside cybersecurity experts, and notified law enforcement.[1]

HCA says its investigation determined that an unknown unauthorized party gained access via a third-party vendor to certain systems on August 12, 2026, and obtained copies of certain files containing personal information.[1] HCA has not named the vendor. The sample letters filed with the California Attorney General list the date of the breach as August 12, 2026.[10] Becker's Hospital Review reports that the sample notification letters are dated November 2.[4]

HCA says it has no indication that the information has been published, further disclosed, or used for unauthorized transactions or identity theft.[1] That is reassuring, but it is not the same as saying the data is safe. The files were copied, and the letters say so plainly.[2]

What information was exposed?

HCA sent different letters to medical residents and to patients.[2]

Medical residents

HCA's letter to medical residents says the files contained human resources information provided in connection with their employment, including:[2]

  • Name
  • Social Security number
  • Date of birth
  • Contact information, including personal email address and phone number
  • Immigration information, where applicable

Patients

The patient letter says the affected files contained certain personal information provided when the person received care at one or more HCA Healthcare-affiliated facilities or physician offices, and that the specific details are listed in each letter.[2] The HIPAA Journal reports that patient data exposed included names, email addresses, phone numbers, dates of birth, Social Security numbers, medical information and health insurance information.[3] Becker's says the Texas filing lists Social Security numbers, medical information and health insurance information among the exposed data, and that the elements vary by person.[4] Your own letter is the best guide to what was involved for you.

How many people are affected?

HCA has not published a total. The confirmed figures so far come from state filings:

  • Texas: 15,096 Texans, according to a filing posted October 30 to the Texas Attorney General's data breach portal, as reported by Becker's and The HIPAA Journal.[4][3][5]
  • Massachusetts: 55 residents, in an October 29 report to state regulators, according to Becker's.[4]
  • Rhode Island: 5 residents, according to the notification letters as reported by Becker's.[4]

So the count is at least 15,096 and may well be higher. Becker's notes that the full count could be higher because HCA has not disclosed a total, and The HIPAA Journal says the number of affected patients has yet to be disclosed.[4][3] Becker's also notes that this follows a 2023 incident in which HCA notified 11.27 million patients.[4]

What should affected patients and residents do now?

  1. Read your letter carefully. It lists the information involved for you and your enrollment code. Keep it.[2]
  2. Enroll in the offered protection. HCA is offering two years of complimentary identity theft protection through IDX, including credit and dark web monitoring, a $1,000,000 insurance reimbursement policy and identity restoration services. The letter says the deadline to enroll is February 2, 2027.[2][1]
  3. Freeze your credit if your SSN was involved. HCA's letter explains that a security freeze is free, that you contact each of the three national credit bureaus, and that while it is in place you cannot get new credit until you lift it.[2] The FTC says a freeze stays in place until you lift it.[6]
  4. Consider a fraud alert. HCA's letter says an initial fraud alert lasts one year and that the bureau you contact notifies the other two. It recommends placing one after you activate the offered credit monitoring.[2][6]
  5. Watch your statements and credit reports. HCA recommends reviewing account statements and monitoring credit reports for anything suspicious.[1]
  6. Consider an IRS IP PIN. HCA did not mention this. It is our suggestion where an SSN and date of birth were exposed. The IRS says an Identity Protection PIN prevents someone else from filing a tax return using your SSN, and that anyone who can verify their identity may get one.[11]
  7. Be wary of calls and emails about the breach. Scammers follow breach news. Use the phone number printed on your letter: HCA's dedicated call center is 1-866-200-0915, Monday to Friday, 8:00 am to 8:00 pm Central Time.[1]

The FTC's IdentityTheft.gov has a checklist of recovery steps after a data breach, and is also where you report identity theft if it happens.[12]

How to watch for medical identity theft

Medical files and insurance details carry a risk that a credit freeze does not cover. The FTC describes medical identity theft as someone using your personal information, such as your name, Social Security number or health insurance account number, to get medical care, buy prescription drugs, or submit claims to your insurer. It says that if a thief's health information is mixed with yours, it could affect the care and benefits you can get.[7]

The FTC's warning signs include:[7]

  • A bill or Explanation of Benefits statement for services you did not get or medications you do not take
  • A debt collector contacting you about medical debt you do not owe
  • Medical collection notices on your credit report that you do not recognize
  • A notice from your insurer saying you reached your benefit limit

Read every Explanation of Benefits statement, not just the bills. If something is wrong, the FTC says to get copies of your medical records from each provider involved, review them for errors, and report errors to the provider in writing.[7]

A note for medical residents

Residents face a slightly different risk because the exposed files were employment records. A name, SSN, date of birth and contact details are enough to attempt new credit, tax fraud or account takeover, and immigration details are sensitive in their own right. A credit freeze and an IRS IP PIN are the two strongest low-cost steps. Residents who move between programs and hospitals also tend to accumulate copies of offer letters, visa paperwork and ID scans on personal laptops, phones and cloud folders. Those copies are worth tidying up now.

Why old devices and records with SSNs or medical files need a proper wipe

Nothing on your own devices caused this breach, and wiping them will not undo it. But it shows how long sensitive records stay around once they are collected. The same is true of the copies you hold yourself: scanned insurance cards, medical bills, employment paperwork, immigration documents and tax forms saved on an old laptop, an external drive or a phone.

For health care organizations, HHS says HIPAA requires covered entities to apply reasonable safeguards when they dispose of protected health information, including policies for the final disposal of electronic media and the hardware it is stored on.[8] For everyone, CISA warns that deleting files or formatting a drive leaves the data recoverable, and that proper sanitization is needed before a device is disposed of.[9] NIST SP 800-88 Rev. 2 is the reference for matching the sanitization method to the type of storage.[13] The FTC adds that paper medical records should be shredded before you throw them away.[7]

We covered why this matters for clinics in the Lehigh Valley HIPAA risk analysis settlement, and for patients in the Quest Diagnostics data breach.

How do you wipe old devices that hold your SSN or medical files?

  1. List the devices. Include old laptops, desktops, external drives, USB sticks and phones you no longer use.
  2. Keep what you need. Back up documents you must keep, such as tax or immigration records, and check the backup opens.
  3. Sign out and remove accounts. Unlink the device from cloud, email and patient portal accounts.
  4. Wipe the whole drive. Deleting or reformatting is not enough on its own.[9] See how to wipe a laptop or PC before selling it and what to do with an old computer.
  5. Handle phones separately. Remove accounts, then factory reset. See how to erase mobile phones before disposal.
  6. Keep a record in a practice or clinic. A documented erasure report shows what was wiped, when and how.

How does RedKey help?

RedKey USB is a reusable USB stick that starts a PC, laptop or Intel-based Mac outside Windows or macOS and erases whole drives, including hard drives, SATA and NVMe SSDs, USB flash drives and memory cards. Its wipe follows NIST SP 800-88 methods and removes hidden areas such as the HPA and DCO on ATA/SATA drives. It is a one-time purchase with unlimited use and no subscription.

For a household, RedKey Home covers old computers and drives and shows the result on screen. Clinics, practices and anyone who needs a record can use RedKey Professional or RedKey Ultimate, which produce a PDF erasure report for each drive. Wiping phones and tablets is available in RedKey Ultimate only.

What RedKey cannot do here

RedKey cannot remove your data from HCA's systems or its vendor's systems, and it does not replace a credit freeze, a fraud alert, an IP PIN or the identity protection HCA is offering. It handles the part you control: the old devices and drives in your own home, practice or office. RedKey is not affiliated with HCA Healthcare.

The bottom line

If you get an HCA letter, read it, enroll in the IDX protection before February 2, 2027, and consider a credit freeze or fraud alert. Watch your Explanation of Benefits statements for care you did not receive. HCA has not published a total, so expect the confirmed count of at least 15,096 to grow. Then deal with the copies you hold yourself, and wipe old laptops, drives and phones that carry SSNs or medical files before they leave your hands.

HCA data breach FAQs

Was my data exposed in the HCA data breach?

Only people who receive a notice letter from HCA Healthcare are confirmed as affected. HCA says the files contained medical resident personal information and patient personal information related to certain affiliated facilities and physician offices, and the patient letter says the specific information varies by person. If you are unsure, call HCA's dedicated call center at 1-866-200-0915, Monday to Friday, 8:00 am to 8:00 pm Central Time.

How many people are affected by the HCA data breach?

HCA has not published a total. A filing on the Texas Attorney General's data breach portal lists 15,096 affected Texans, and Becker's Hospital Review reports filings showing 55 Massachusetts residents and 5 Rhode Island residents. The full count may be higher as more state filings appear.

What information was involved?

For medical residents, HCA's letter lists human resources information including name, Social Security number, date of birth, personal email address and phone number, and immigration information where applicable. For patients, the letter says the files held information provided when receiving care at HCA-affiliated facilities or physician offices, and the elements vary by person. The HIPAA Journal reports that patient data included names, contact details, dates of birth, Social Security numbers, medical information and health insurance information.

What is HCA offering affected people?

HCA is offering two years of complimentary identity theft protection through IDX, including credit and dark web monitoring, a $1,000,000 insurance reimbursement policy and identity restoration services. The letter says the deadline to enroll is February 2, 2027, using the enrollment code printed on your letter.

Should I freeze my credit after the HCA data breach?

If your letter says your Social Security number was involved, a credit freeze is a strong step. HCA's letter explains that a freeze is free and that you contact each of the three national credit bureaus. A fraud alert is another free option that lasts one year. HCA suggests placing a fraud alert after you activate the offered credit monitoring.

How do I spot medical identity theft?

The FTC lists warning signs such as a bill or Explanation of Benefits statement for care you did not get, a debt collector contacting you about medical debt you do not owe, unfamiliar medical collections on your credit report, or a notice that you reached your benefit limit. Read every Explanation of Benefits statement and report errors to your insurer and provider.

Will wiping my old laptop protect me from this breach?

No. The breach involved HCA's systems, and wiping your own devices does not undo it. What a proper wipe does is remove the copies you control, such as scanned IDs, employment paperwork, immigration documents and medical bills saved on old laptops and drives, so they cannot be recovered by whoever ends up with those devices.

Which RedKey editions produce a PDF erasure report?

RedKey Professional and Ultimate produce a PDF erasure report. RedKey Home shows results on screen only. Mobile device wiping is available in RedKey Ultimate only.

Sources

  1. HCA Healthcare, Notice of security incident (substitute notice)
  2. HCA Healthcare, Notice of Data Breach, individual notification templates, as filed with the California Attorney General
  3. The HIPAA Journal, Data Breaches Announced by HCA Healthcare; Blossom Health (November 4, 2026)
  4. Becker's Hospital Review, HCA data breach hits more than 15,000 people
  5. Texas Attorney General, Data Security Breach Reports
  6. FTC Consumer Advice, Credit Freezes and Fraud Alerts
  7. FTC Consumer Advice, What To Know About Medical Identity Theft
  8. HHS, What does HIPAA require of covered entities when they dispose of protected health information?
  9. CISA, Proper Disposal of Electronic Devices
  10. California Attorney General, Submitted Breach Notification Sample: HCA Healthcare, Inc.
  11. IRS, Get an Identity Protection PIN (IP PIN)
  12. FTC, IdentityTheft.gov: Data breach recovery steps
  13. NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)

This article is general information, accurate as of November 6, 2026, and based on the HCA Healthcare notice and letters, state attorney general filings, The HIPAA Journal, Becker's Hospital Review, FTC, IRS, HHS, CISA and NIST sources listed. Affected counts may rise as more filings appear. It is not legal, medical or financial advice.

Back to blog