SPRING HILL, Fla. — HCA Healthcare recently noticed that an unauthorized party was able to access millions of patients' information including their name, date of birth, city, state and future appointments.
So far in the investigation, HCA Healthcare believes the theft stemmed from an external storage location "exclusively used to automate the formatting of email messages."
A list was accessed that included the information of about 11 million HCA Healthcare patients, the healthcare system said. They also reported the incident to law enforcement and retained third-party forensic and threat intelligence advisors following the data breach.
"While our investigation is ongoing, the company has not identified evidence of any malicious activity on HCA Healthcare networks or systems related to this incident," the healthcare system said in an update.
HCA Healthcare said they are sure the unauthorized party was unable to get information regarding patients' clinical information, such as treatment, diagnosis and condition; payment information; or sensitive information such as passwords, driver's licenses or social security numbers.
For now, HCA Healthcare is offering credit monitoring and identity protection services, where appropriate. In an effort to prevent another data breach, HCA Healthcare has disabled user access to the storage location as an immediate containment measure.
"We encourage patients to remain vigilant in identifying calls, emails or SMS texts which appear to be spam or fraudulent," HCA Healthcare said. "Additionally, patients should never open links or attachments sent from untrusted sources."
If patients have questions about an invoice, balance or payment reminder that doesn't seem authentic, contact HCA Healthcare at 844-608-1803.