Fourteen Medical City Healthcare hospitals are among the hundreds of facilities caught up in an apparent patient data theft at the North Texas hospital operator’s parent company, HCA Healthcare. HCA says that information from around 11 million patients was “made available by an unknown and unauthorized party” in an online forum.
HCA believes that clinical and payment information was not part of the breach, but name, address, email, phone number, and service date and location were included in what was stolen. Credit card information, passwords, driver’s license numbers, and social security numbers are not believed to be a part of the theft.
Fourteen HCA-owned North Texas hospitals and dozens of other care sites, including CareNow urgent care centers, North Texas Heart Centers
Nashville-based HCA is one of the nation’s largest hospital operators, with 180 hospitals and 2,300 ambulatory care sites in 20 states and the UK. Founded in 1968, the system experiences 37 million patient encounters each year. In 2016, HCA’s North Texas hospitals rebranded as Medical City Healthcare, which today includes 16 hospitals, 3,696 hospital beds, 17,000 employees, and 1.3 million annual outpatient visits.
HCA says that the data was apparently stolen from an external storage location exclusively used for automating email messages and that there will be no service or operations disruptions. At the time of the release, HCA says the data theft will not impact the company’s business or finances. After dipping about 1 percent this morning, HCA’s stock price stabilized by lunchtime.
HCA reported the event to law enforcement and hired its own forensic and threat intelligence advisors but has not yet identified malicious activity on HCA’s networks. A release said that impacted patients will be contacted with additional information and support.
HCA says it will offer credit monitoring and identity protection services where appropriate and encourages patients to identify suspicious calls, emails, or texts. Patients can call (844) 608-1803 to verify the veracity of messages from HCA.
HCA said it didn’t know the exact number of patients impacted by the theft but estimated that around 27 million rows of data, including information from 11 million patients, was part of what was shared.
HCA has disabled user access to the location that was breached. “The company’s efforts to protect data include ongoing education for our colleagues, physicians, vendors, and others to maintain awareness of safe practices that can help ensure compliance and the security of our information,” the release stated.
North Texas is no stranger to data breaches. The City of Dallas experienced a massive ransomware attack earlier this year, impacting the city’s systems for weeks. Earlier this year, Dallas Central Appraisal District paid $170,000 to attackers after a ransomware attack knocked its website offline for two months. In June, the City of Fort Worth was hacked by a group protesting the state’s policies on gender-affirming care.
According to information in the releases, there have been no demands for ransom connected to HCA’s apparent data theft. Check out all the impacted facilities here.
Author
