HCA Healthcare Notifies Individuals of August 2026 Data Breach Involving Resident and Patient Information

What the notice says

HCA Healthcare filed a notice with the California Attorney General describing a cybersecurity incident that involved personal information tied to medical residents and to patients treated at its affiliated facilities. The notice states that HCA Healthcare's investigation found that . For one group of recipients, the files involved included name, Social Security number, date of birth, contact information, personal email address and phone number, and immigration information where applicable, drawn from Human Resources records. A separate version of the notice sent to patients states that , with the specific data elements left as a variable field in the template filed with the attorney general. HCA Healthcare is offering two years of complimentary identity theft protection services through IDX to recipients.

What the notice leaves open

The notice as filed does not state a total number of individuals affected across all states. It does specify that The document does not identify what specific patient data elements were exposed for the general patient population, nor does it describe how the unauthorized access occurred or name any responsible party.