HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls
HCA Healthcare’s 2023 breach came from storage used to format patient emails, not from clinical systems. Outreach data looks harmless one field at a time, but together it is protected health information and needs EHR-grade ownership, inventory and minimization.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On July 10, 2023, HCA Healthcare, one of the largest hospital operators in the United States, disclosed that a list of patient information had been posted on an online forum and offered for sale. HCA said the data came from an external storage location used exclusively to automate the formatting of email messages. It covered roughly 11 million patients across its facilities, in about 27 million rows. The fields included names, addresses, email addresses, phone numbers, dates of birth, gender, service dates and locations, and next appointment dates. HCA said it did not believe clinical information, payment details, passwords or Social Security numbers were involved. Class action suits followed within days, and HCA said it would notify affected patients and regulators.
Health systems spend heavily protecting the electronic health record. HCA’s breach came from somewhere else: a file store supporting patient emails. That system held no diagnoses, yet it still described millions of people as patients of particular hospitals on particular dates. It is a useful case because nearly every health system now runs a similar outreach stack for reminders, surveys, campaigns and portal invitations. We look at it in four parts: what outreach data actually is, where it lives, who governs it, and how to design engagement that exposes less.
What outreach data is
A name, an email address and an appointment date look like contact information. In a health system’s hands they are more. The fact that a person received care at a named facility on a named date is health information. When a covered entity or business associate holds it in identifiable form, it is protected health information under HIPAA. A next-appointment date at a cancer center or behavioral health clinic says even more.
That classification has consequences. Outreach data is subject to the HIPAA Security Rule, to breach notification, and to state laws on health data. It also has value to criminals beyond identity theft. A list of patients with upcoming appointments supports convincing phishing: a message about a rescheduled visit, sent days before the genuine one, is hard for a patient to doubt.
Many organizations nonetheless classify outreach extracts as low sensitivity because no single field is clinical. The first fix is a classification rule that judges the record, not the field: any record linking a person to a care event is PHI, wherever it sits.
Where it lives
Outreach data moves. A nightly job extracts appointments from the EHR and sends them to a reminder vendor. A marketing team loads a list into a campaign platform. A survey vendor receives discharge records. An integration team stages files in cloud storage so a formatting service can build emails. Each copy is a separate data store, often in a separate cloud account, sometimes with a separate vendor.
These stores are rarely in the security team’s inventory. They were set up by engagement or marketing teams to solve a delivery problem, often with service accounts that never expire and storage that is never purged. Retention is the quiet multiplier. A staging location used to format a single campaign may still hold every list ever sent through it.
Finding them requires looking at data flows rather than applications. Start with every outbound interface from the EHR and data warehouse. Scan cloud accounts for files containing patient identifiers. Ask each vendor that sends patient messages to list where it stores the data, for how long, and which subcontractors touch it. The answers often reveal a second tier of vendors, such as email delivery services, that no business associate agreement names.
Who governs it
Clinical systems have clear owners: a chief medical information officer, an EHR team, defined access reviews. Outreach systems usually belong to marketing, patient experience or access centers, whose leaders are measured on response rates and no-show reductions, not on data protection.
That split leaves gaps. Business associate agreements may exist for the main vendor but not for its subcontractors. Access reviews may cover the EHR but not the campaign platform. Security monitoring may watch clinical servers but not a storage bucket in a marketing team’s cloud account.
The fix is to bring the outreach stack under the same governance as clinical data without taking ownership away from the teams that run it. Each system needs a named business owner and a named security contact. It should appear in the risk analysis HIPAA already requires, with the same access reviews, logging and vendor assessments as clinical systems. The chief privacy officer should approve new outreach data flows, in the same way a new interface from the EHR would be approved.
How to engage with less exposure
The best protection is to hold less. Most outreach does not need date of birth, full address and service location in the same file. A reminder needs a name, a contact channel, a time and a place. A survey needs an identifier and a contact channel. Sending minimum fields per use case reduces what any one store can leak.
Several design choices help further. Tokenized identifiers let a vendor send messages without holding the medical record number. Short retention, enforced by automated deletion, keeps staging stores from accumulating history. Messages can point patients to the portal for details rather than placing appointment information in the email itself. Each choice has a cost: more integration work, less personalized messages, slightly lower response rates. Patient experience leaders should weigh those costs with privacy officers rather than alone.
The trade-off runs in both directions. Patient engagement is valuable, and over-restricting it pushes teams toward unsanctioned tools. A health system that gives engagement teams an approved, well-governed platform with clear data rules is likely to end up with fewer stray copies than one that simply says no.
With hindsight
HCA’s incident was among the largest healthcare breaches reported in 2023. It arrived while regulators were already pressing hospitals and telehealth providers over tracking technologies on websites and apps, which send data about patient activity to third parties. In June 2024 a federal court in Texas vacated part of HHS’s guidance on online tracking, the part covering unauthenticated public web pages. Litigation and state enforcement over tracking continued regardless. Together these episodes moved attention from the EHR as the only crown jewel to the systems around the patient: marketing, analytics, engagement and communications. The HCA case remains a clear example of the risk that sits there: data that nobody had classified as sensitive, held outside the controls built for the record.