HCA Healthcare and Blossom Health disclose data breaches, HIPAA Journal reports

What happened

HCA Healthcare and Blossom Health have disclosed separate data security incidents, according to a roundup published by HIPAA Journal on November 4, 2026. The same report also covers disclosures by El Camino Health and University of Mississippi Medical Center. All details below come from that one outlet’s summary of the organizations’ notices. No other independent reporting was available. The total number of affected people has not been disclosed for any of the four organizations.

HCA Healthcare. HIPAA Journal reports that HCA Healthcare disclosed a cybersecurity incident first identified on August 12, 2026. The outlet describes HCA as the operator of 189 hospitals and approximately 2,600 ambulatory sites of care in 19 U.S. states (HIPAA Journal). According to the report:

• HCA says it identified suspicious activity in certain IT systems. HCA says its forensic investigation confirmed unauthorized access on August 12, 2026.
• HCA says the threat actor obtained copies of certain HR files containing medical resident personal information. According to HCA, these files held name, date of birth, email address, phone number, Social Security number and immigration information.
• According to the report, patient data related to certain affiliated facilities and physician offices was also exposed. This data included names, email addresses, phone numbers, dates of birth, Social Security numbers, medical information and health insurance information.
• The total number of affected patients has not been disclosed. HIPAA Journal reports that 15,096 Texas residents are known to be affected.
• According to the report, affected individuals have been offered two years of complimentary credit monitoring.

The entry point and the identity of the attacker are not confirmed.

Blossom Health. HIPAA Journal reports that Blossom BH Opco Inc., doing business as Blossom Health, has started notifying certain patients about an August 2026 incident. The outlet describes Blossom Health as an online telepsychiatry and virtual mental health provider. The incident involved unauthorized access to its electronic health record (EHR) software (HIPAA Journal). According to the report:

• Blossom Health’s October 29, 2026 notification letters say an unauthorized actor gained access to the EHR software and patient data through a phishing attack on a non-employee contractor.
• Blossom Health says the exposed information included names, contact information and health insurance information. It says financial information and Social Security numbers were not accessible.
• Blossom Health’s website regulatory disclosure says the actor downloaded a limited number of patient medical records and a user spreadsheet containing patient information.
• Blossom Health says the access has been blocked, user passwords have been changed and additional technical security measures have been deployed.
• The Texas Attorney General was informed that 2,103 Texas residents are affected. The total number of affected people has not been disclosed.

Also in the report:

• El Camino Health. HIPAA Journal reports that El Camino Health says an unauthorized individual accessed four Microsoft 365 accounts. The accounts were accessed intermittently between August 26, 2026 and September 2, 2026, and certain documents were copied or downloaded. El Camino says the files included Social Security numbers, driver’s license numbers, medical and treatment information and health insurance information. For a subset of patients, it says financial account and routing numbers were also compromised (HIPAA Journal).
• University of Mississippi Medical Center (UMMC). According to the same report, UMMC says its network was subject to unauthorized access between February 11, 2026 and February 19, 2026. UMMC’s notice to the California Attorney General does not state the data types involved or the number of affected people. HIPAA Journal says this appears to have been a ransomware attack. It reports that the Medusa ransomware group claimed responsibility in March 2026 and that the ransom was not paid (HIPAA Journal).

Am I affected?

• HCA Healthcare medical residents and patients of certain HCA-affiliated facilities and physician offices may be affected, according to HIPAA Journal. The source does not say which facilities are involved.
• Blossom Health patients may be affected. The report says Blossom Health is notifying certain patients and references notification letters dated October 29, 2026 (HIPAA Journal).
• El Camino Health and UMMC patients may be affected. The source does not give the scope for either organization.
• The source names no software product, package or version, so it does not identify any affected developer dependency.

What to do now

1. If you received a notice from HCA Healthcare, enroll in the two years of complimentary credit monitoring it offers (HIPAA Journal).
2. If you received a notice from Blossom Health, enroll in the offered single-bureau credit report, credit score and credit monitoring services (HIPAA Journal).
3. If you received a notice from El Camino Health, enroll in the offered credit monitoring and identity theft protection services (HIPAA Journal).
4. If you are a UMMC patient, watch for a direct notice. HIPAA Journal reports that there was no substitute data breach notice on the UMMC website at the time of reporting (HIPAA Journal).

Sources

• HIPAA Journal: Data Breaches Announced by HCA Healthcare; Blossom Health