The largest for-profit hospital chain in the country has started mailing notices for a summer intrusion. HCA Healthcare said an unknown party got into certain IT systems on August 12, 2026, and walked out with copies of files holding medical resident and patient information.
The resident letters describe Human Resources records: names, Social Security numbers, dates of birth, personal email addresses and phone numbers, and immigration information where applicable. Patient letters say the files held personal details submitted when someone received care at an HCA-affiliated facility or physician office, with specific data types filled in per recipient.
Both letters offer two years of IDX identity protection, including credit and dark web monitoring, a $1M insurance reimbursement policy, and enrollment by February 2, 2027. HCA said it has no indication the data has been published or used for fraudulent transactions.
Scale is still moving. The class action firm tracking the matter cites attorney general filings showing at least 15,096 affected people in Texas, with separate reports reaching Massachusetts regulators, so the national count is likely to climb.
For hospitals running graduate medical education programs, the file is a reminder that HR stores – onboarding packets, visa paperwork, direct deposit details – sit on the same network as clinical systems and carry the identifiers regulators care about most. Chain-wide breach work also has to span dozens of state notification statutes with different deadline clocks.
