HCA’s data on 11 million patients sat in an email-formatting store, outside the EHR’s controls

The week

On July 10, 2023, HCA Healthcare, one of the largest hospital operators in the United States, disclosed that a list of patient information had been posted on an online forum and offered for sale. Criminals were openly advertising the data to buyers.

The company was no small target with thin defenses. By its own description at the time, Nashville-based HCA ran 180 hospitals and about 2,300 ambulatory sites of care in 20 states and the United Kingdom. Those sites included surgery centers, freestanding emergency rooms, urgent care centers and physician clinics. HCA reported more than 37 million patient encounters a year. An operator of that size runs mature security programs around its clinical systems.

Hospitals guard the electronic health record, the digital chart holding diagnoses, medications and test results, more closely than anything else they run. So it was striking that one of the largest health data exposures of the year came from somewhere much more ordinary: the machinery for sending patients emails.

HCA said the data came from an external storage location used exclusively to automate the formatting of email messages. It was a holding area where lists of names and appointment details sit so that software can turn them into neatly formatted reminders and messages. It was not the clinical record system.

HCA said the list might include information for approximately 11 million patients. The fields included:

• names, with city, state and ZIP code;
• email addresses and phone numbers;
• dates of birth and gender;
• service dates and locations; and
• next appointment dates.

The release also said what the list was for. It supported emails such as reminders that patients might wish to schedule an appointment, and education on healthcare programs and services. That description places the data where appointment management, patient communication and service promotion overlap. Inside a health system, ownership tends to blur in exactly that zone.

HCA said it did not believe clinical information, payment details, passwords or Social Security numbers were involved. On a quick reading, that sounds reassuring. No diagnoses, no card numbers. But look at the list again. It says who was a patient, at which facility, on which date, and when they are next expected. That is a great deal to know about a person, and it is health information in its own right.

The company set out its first steps. It reported the incident to law enforcement and retained outside forensic and threat intelligence advisors. As an immediate containment measure, it disabled user access to the storage location. It said it had found no evidence of malicious activity on its own networks or systems, and that patient care was not disrupted.

HCA also said it did not expect the incident to have a material effect on its business or financial results. It planned to contact affected patients and offer credit monitoring and identity protection services where appropriate. The disclosure arrived as a Form 8-K, the report a public company files with the Securities and Exchange Commission to tell investors about significant events. So the incident entered the public record the day the company acknowledged it, well before the individual letters HIPAA requires.

The timing carried its own context. Since late May, a criminal group had been exploiting a flaw in MOVEit Transfer, a widely used file-transfer product, to steal data from hundreds of organizations, health organizations among them. Ten days after HCA’s disclosure, on July 20, the Federal Trade Commission and the Department of Health and Human Services wrote to about 130 hospital systems and telehealth providers. Their letters warned about online tracking technologies on websites and apps.

Within a few weeks, three different stories pointed the same way. Patient data was escaping through the systems that move, format and measure it, rather than through the clinical record itself.

Class action lawsuits followed, as they now routinely do after large breaches. HCA said it would notify affected patients and regulators. For other health systems watching, the uncomfortable question was immediate: where does our own email and reminder data sit, and who is looking after it?

Health systems spend heavily protecting the electronic health record. HCA’s breach came from somewhere else: a file store supporting patient emails. That system held no diagnoses, yet it still described millions of people as patients of particular hospitals on particular dates.

It is a useful case because nearly every health system now runs a similar outreach stack: the collection of tools used for appointment reminders, satisfaction surveys, marketing campaigns and invitations to the patient portal. These tools improve care and reduce missed appointments. They also copy patient data into places the security team may never have looked.

The argument below follows that data in order. It starts with what outreach data is and why the law treats it as health information. It then covers where the copies live, the journey of a single reminder, and what a breach costs even without diagnoses. The last parts deal with who should govern these systems, how to engage patients with less exposure, and how to draw the map before it is needed. A short self-check closes the piece.

What outreach data is, and why it counts as health information

A name, an email address and an appointment date look like contact information. In a health system’s hands they are more.

The fact that a person received care at a named facility on a named date is health information. When a covered entity, such as a hospital or health plan, or a business associate, meaning a vendor handling patient data on its behalf, holds that information in identifiable form, it is protected health information (PHI) under HIPAA, the federal law that sets rules for health privacy and security.

A next-appointment date at a cancer center or behavioral health clinic says even more. Nobody needs to see a diagnosis to draw a conclusion from the name of the clinic.

That classification has consequences. Outreach data is subject to the HIPAA Security Rule, which requires safeguards such as access controls and risk analysis. It is subject to breach notification, meaning patients and regulators must be told when it leaks. And it is subject to state laws on health data.

It also has value to criminals beyond identity theft. A list of patients with upcoming appointments supports convincing phishing, the practice of sending fraudulent messages that impersonate a trusted organization to trick people into revealing information or paying money. A message about a rescheduled visit, sent days before the genuine one, is hard for a patient to doubt. It knows their name, their hospital and their appointment. Why would it be fake?

Many organizations nonetheless classify outreach extracts as low sensitivity because no single field is clinical. Here the classification goes wrong. Outreach data works like a jigsaw puzzle: no single piece shows the picture, but together they do. The first fix is a classification rule that judges the record, not the field: any record linking a person to a care event is PHI, wherever it is stored.

Permitted to use is different from safe to hold

Much of the confusion comes from mixing two separate HIPAA questions. The first is whether a health system may use patient data for outreach at all. The second is how it must protect that data while it does.

On the first question, the answer is usually yes. Appointment reminders are generally treated as part of treatment or health care operations, so they need no special patient authorization. Since the 2013 Omnibus Rule, communications about a covered entity’s own health-related products and services are generally not “marketing” under HIPAA. The picture changes when a third party pays for the communication. Then patient authorization is normally required. Organizations should check with counsel on the edge cases.

Fundraising is a third permitted path, and one that academic medical centers and nonprofit systems use heavily. HIPAA allows a covered entity to use certain information for its own fundraising without authorization. That includes demographics, dates of service, the department of service and the treating physician. Each fundraising message must offer a clear way to opt out.

On the second question, permission changes nothing. A permitted use still requires Security Rule safeguards: risk analysis, access control, audit capability and contracts with any vendor that holds the data. Teams that hear “we are allowed to send this” sometimes conclude “this is low risk.” The first statement can be true while the second is false.

What the location name gives away

The service location field deserves particular care. A list that shows a visit to a general medical campus reveals little beyond the visit. A list that shows a visit to an infusion center, a fertility clinic, an addiction treatment program or a gender clinic reveals far more.

Some of those service lines carry their own legal layers. Records from federally assisted substance use disorder programs are subject to additional confidentiality rules under 42 CFR Part 2. Several states also impose medical privacy and breach notification requirements that are stricter than HIPAA’s. A single outreach extract that spans every department therefore carries the legal weight of its most sensitive department.

A practical response is to rank service lines by what their names reveal. The most revealing ones can then use neutral location labels in outreach, such as a building name or a street address, rather than the clinic’s specialty.

Making the record-level rule work

A rule that classifies by record rather than field needs mechanics behind it. In most organizations that means three things.

• A plain test. If a dataset links an identifiable person to a provider, a facility or a date of care, it is PHI. Staff should be able to apply the test without calling the privacy office.
• Labels that travel with the data. Data loss prevention and cloud data discovery tools can tag files and tables that match the test, so the label follows extracts into new stores.
• A default for the unknown. Any extract whose contents are not documented is treated as PHI until someone shows otherwise.

The default matters most. It shifts the burden of proof from the security team, which has to find each risky store, to the team that created it, which knows what it contains.

Where it lives

Outreach data moves, and the risk only becomes clear when you follow it.

A nightly job extracts appointments from the EHR and sends them to a reminder vendor. A marketing team loads a list into a campaign platform. A survey vendor receives discharge records. An integration team stages files in cloud storage so a formatting service can build emails. “Staging” here means a holding area where files wait to be processed.

Each copy is a separate data store, often in a separate cloud account, sometimes with a separate vendor. Cloud storage is rented space on servers run by a large provider, set up in minutes by anyone with an account and a budget. That convenience is exactly why it multiplies.

These stores are rarely in the security team’s inventory. They were set up by engagement or marketing teams to solve a delivery problem, often with service accounts (logins used by software rather than people) that never expire, and storage that is never purged.

Retention multiplies the risk. A staging location used to format a single campaign may still hold every list ever sent through it. A holding area becomes an archive, and nobody notices because nobody goes there.

Finding these stores requires looking at data flows rather than applications. Start with every outbound interface from the EHR and the data warehouse, the central repository where a health system pools data for reporting and analysis. Scan cloud accounts for files containing patient identifiers. Ask each vendor that sends patient messages to list where it stores the data, for how long, and which subcontractors touch it.

The answers often reveal a second tier of vendors, such as email delivery services, that no business associate agreement names. A business associate agreement is the contract HIPAA requires before a vendor can handle PHI; it commits the vendor to protecting the data and reporting breaches. A subcontractor outside that chain of contracts is a gap in both law and practice.

The usual places copies land

Outreach copies cluster in a handful of predictable places. Knowing them shortens any search.

• Engagement and CRM platforms. Customer relationship management systems adapted for healthcare often hold a broad copy of patient demographics and visit history, refreshed daily.
• Marketing automation tools. Campaign platforms keep lists, segments and send histories, often for as long as the license runs.
• Survey vendors. Hospitals paid under Medicare’s inpatient prospective payment system must collect the HCAHPS patient experience survey to receive their full annual payment update. Most use approved outside vendors, who receive regular discharge lists. Other surveys add more vendors.
• Staging storage and file transfer. Cloud storage buckets and secure file transfer servers hold files in transit, and often long after.
• Analytics sandboxes. Analysts building no-show models or campaign reports pull their own extracts and keep them.

The survey case shows that some outbound flows are not optional. A hospital cannot simply stop sending discharge lists to its survey vendor. It can control which fields go, how they travel and how long the vendor keeps them.

How discovery works in a real organization

Technical scanning finds some stores. Cloud security posture tools flag storage that is publicly reachable or broadly shared. Data discovery tools look for combinations of patterns, such as names next to dates of birth and facility names.

Scanning misses whatever is held in a vendor’s environment, so it needs a paper trail as well. Accounts payable is a good starting point. Every outreach vendor is paid by someone, and the payment records name vendors that no architecture diagram shows. The EHR’s own scheduled report and extract jobs are a second trail. Each one has a destination, a schedule and a requester.

A third trail comes from people. Engagement, marketing, access center and patient experience leaders can usually list their tools in an afternoon if asked directly and without blame.

Large systems and small networks differ

The inventory problem looks different by size. A large health system typically has an integration team and an interface engine, a hub that routes data between systems. Its outbound flows are numerous but at least pass through a point that can be watched.

An ambulatory network or physician group often uses the reminder module built into its practice management or EHR vendor’s product. The data may never leave that vendor’s environment as a file the practice can see. For such organizations the inventory question becomes a contract question: what the vendor does with the data, where, with which subcontractors and for how long.

The journey of a single appointment reminder

To see how many hands patient data passes through, follow one ordinary reminder at a typical hospital.

A patient books a follow-up visit with a cardiologist. The booking goes into the EHR, where it is protected by the hospital’s strongest controls: role-based access, audit trails, regular reviews of who can see what.

That night, an automated job pulls tomorrow’s and next week’s appointments from the EHR into a file. The file includes the patient’s name, phone number, email, the clinic name, the appointment time and, because the template was built years ago and nobody trimmed it, the date of birth too. The file is placed in a cloud storage folder.

A formatting service, run by a vendor, picks up the file from the folder, merges each row into a message template and produces finished emails and texts. Those messages are handed to an email delivery company and a text-messaging provider, which actually send them. Each of those companies keeps logs, and sometimes copies, for its own troubleshooting.

The patient receives a friendly reminder and turns up on time. From the hospital’s point of view, the system worked perfectly.

Now count the copies. The appointment exists in the EHR, in the nightly file and in the cloud folder, along with every previous night’s file if nobody set a deletion rule. It also exists at the formatting vendor, at the email company and at the text provider. Only the first of those six places sits inside the controls the hospital built for clinical data. The other five are governed, if at all, by whoever set them up and by whatever the contracts happen to say.

Multiply that by surveys, marketing campaigns, portal invitations and billing reminders, each with its own path, and the picture becomes clear. The patient’s record is guarded in one place and copied into many.

What can go wrong at each stop

Each copy fails in its own way. Knowing the typical failure at each stop tells a security team where to look first.

• The extract job. Templates grow fields over time and rarely shrink. A field added for one campaign stays for years.
• The staging folder. Access policies are set broadly to get a project working and never tightened. Deletion rules are missing.
• The credentials. Service account keys sit in scripts or configuration files, never rotate and often outlive the people who created them.
• The formatting vendor. Its staff may hold broad administrative access, and its test environments may contain production data.
• The delivery providers. Logs kept for troubleshooting can include message content, recipient details and delivery times.

Where responsibility changes hands

Ownership of the staging location matters more than it appears. If the bucket lives in the health system’s cloud account, the health system sets its access rules and sees its logs. If it lives in the vendor’s account, the health system sees nothing unless the contract requires reporting.

Cloud providers work on a shared responsibility model. They secure the underlying infrastructure. The customer configures who can reach the data. Neither the vendor nor the cloud provider takes on the hospital’s HIPAA obligations. A covered entity remains accountable for its patients’ data, and its business associates are directly liable for their own compliance.

The message itself is a copy

The finished reminder is also a disclosure. Text messages pass through carriers in a form the hospital does not control. Emails rest in inboxes that patients share with family or access on shared devices.

HHS has long allowed covered entities to communicate with patients by unencrypted email or text when patients prefer it and have been told of the risks. That permission does not shrink the content. Every detail placed in the message body is another copy, held somewhere the hospital will never audit.

The cost of a breach without diagnoses

A breach of outreach data is not a lesser breach because it lacks diagnoses. For a health system, the costs arrive on several fronts.

Regulatory. Because the data is PHI, the full machinery of HIPAA breach notification applies: letters to patients, reports to federal regulators and, for large breaches, public disclosure. State attorneys general may take an interest too.

Legal. As HCA’s experience showed, class actions now follow large breaches quickly. Defending them is expensive whatever the outcome.

Patients. The harm to patients is real even without clinical details. They face targeted scams, and some will feel that a private fact, that they were treated at a particular facility, is now known to strangers. Trust affects whether patients answer messages, use the portal and return for care.

Operations. After a breach, outreach programs are often paused or scaled back while the organization investigates. The reminders that reduce missed appointments stop. The surveys that inform service improvement stop. The cost of that pause rarely appears in breach estimates, but it is felt in clinics.

Reputation. Headlines about millions of patients do not distinguish between clinical and outreach data. The public hears “hospital breach,” and the board hears it too.

Board oversight. Boards are used to receiving reports on the security of clinical systems. Few receive a view of the outreach stack, because it rarely appears in the same reports. That is a gap a board can close simply by asking for it. A one-page map showing where patient data goes for engagement purposes, who owns each stop, and when each was last reviewed would tell directors more about this risk than a long technical briefing. If management cannot produce the map, directors have learned that nobody is tracking these copies.

How the notification machinery runs

The HIPAA Breach Notification Rule sets the sequence. Individuals must be notified without unreasonable delay and no later than 60 calendar days after the breach is discovered. When a breach affects more than 500 residents of a state or jurisdiction, prominent media outlets there must also be told. Breaches of 500 or more people must be reported to HHS at the same time. HHS then posts them on its public breach portal.

The rule presumes that an unauthorized disclosure is a breach. The organization can rebut that presumption only by showing a low probability that the data was compromised, based on a four-factor assessment. The factors cover the nature of the data, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated. A list offered for sale on a criminal forum leaves little room for that argument.

What an investigator asks for

Large breaches typically draw an inquiry from HHS’s Office for Civil Rights. The requests follow a familiar pattern, and the answers either exist already or have to be assembled under pressure.

• The most recent enterprise risk analysis, and whether it covered the system that leaked.
• The business associate agreement with each vendor involved, and with their subcontractors.
• Policies on access control, audit logging and data retention, and evidence that they were followed.
• Logs showing who accessed the store and when.
• The timeline of discovery, containment and notification.

An outreach store that never appeared in the risk analysis is a finding in itself. It suggests the analysis was incomplete, and incomplete risk analysis has featured in many of the office’s settlements.

The litigation mechanics

Data breach class actions usually plead negligence, breach of implied contract and invasion of privacy. Defendants often challenge standing. The Supreme Court’s 2021 decision in TransUnion v. Ramirez held that the mere risk of future harm does not by itself support standing to seek damages.

Courts have divided on how that applies to stolen data. A list that was actually advertised for sale gives plaintiffs a stronger story of concrete risk than a server that was merely exposed. Health systems should take their own legal advice. For planning purposes, assume that any large outreach breach will be litigated whatever its fields.

The response bill

The direct work of a response is substantial even without regulatory penalties. It typically involves outside counsel, a forensic firm, a mailing vendor for letters, a call center for worried patients and a credit monitoring provider. Many of those costs scale with the number of people notified, not with the sensitivity of the fields. That makes a large, low-sensitivity list expensive.

Public company status adds another channel. HCA reported through an 8-K. A nonprofit system has no 8-K, but if it has publicly traded bonds, it can expect questions from investors and rating agencies. The same facts must be told consistently to regulators, patients, investors and the press, which is hard when the facts are still emerging.

Who governs it

Clinical systems have clear owners: a chief medical information officer, an EHR team, defined access reviews. Outreach systems usually belong to marketing, patient experience or access centers, whose leaders are measured on response rates and no-show reductions, not on data protection. That reflects how their incentives are set rather than any failing of theirs.

That split leaves gaps. Business associate agreements may exist for the main vendor but not for its subcontractors. Access reviews may cover the EHR but not the campaign platform. Security monitoring may watch clinical servers but not a storage bucket in a marketing team’s cloud account.

The fix is to bring the outreach stack under the same governance as clinical data without taking ownership away from the teams that run it. Each system needs a named business owner and a named security contact. It should appear in the risk analysis HIPAA already requires, with the same access reviews, logging and vendor assessments as clinical systems.

The chief privacy officer should approve new outreach data flows, in the same way a new interface from the EHR would be approved. An interface, in this sense, is any automated feed that moves data from one system to another. If a feed carries patient data out of the building, someone accountable for patient data should know it exists.

Suppose a health system’s patient experience team wants to launch a post-discharge text survey. Under the old way of working, the team signs a contract with a survey vendor, sets up a nightly file and goes live. Nobody in security hears about it. Under the governed approach, the request triggers a short privacy review. The review asks which fields the survey needs, where the vendor stores them, for how long, and who its subcontractors are. The survey launches two weeks later than the team wanted, with fewer fields, a ninety-day deletion rule and a signed agreement covering the text-messaging provider. The patient experience team still owns the survey, and the privacy review has set the terms on which its data is collected, stored and deleted.

Splitting the roles

Clear governance does not mean one team owns everything. It means each decision has a named owner.

• Engagement, marketing or patient experience owns the purpose of each program, its content and its results.
• The privacy office decides whether a use is permitted, which fields it needs and what patients are told.
• Security owns the controls on each store, the monitoring and the response plan.
• Integration or IT owns the extract jobs, credentials and transfer mechanisms.
• Procurement and legal own the contract terms, including subcontractor coverage and deletion obligations.
• Records management sets retention periods and checks that deletion happens.

Writing those roles down sounds bureaucratic. Without them, each team reasonably assumes another has checked the parts it cannot see.

Metrics a board or audit committee can track

A small set of measures shows whether the outreach stack is under control. Useful ones include the share of outreach flows with a named owner and a current agreement, and the share of staging stores with automated deletion. Others are the time since each system’s last access review, and the number of vendors whose subcontractors are documented. None requires new technology. Each can be reported quarterly from the outreach map.

Differences by type of organization

The governance shape varies with the organization. An academic medical center adds research recruitment and philanthropic fundraising to the usual reminders and surveys. Each has its own rules and its own office. A health plan runs member outreach for care management and plan communications, often through many vendors at once.

A county or public hospital faces state public records and procurement rules. Those can make vendor contracts visible and slow to change. A small ambulatory network may have no privacy officer at all beyond a compliance lead with several other jobs. For that network, governance means a short vendor questionnaire and a calendar reminder to repeat it.

The case against centralizing review

The strongest objection to this model is speed. Engagement teams work on campaign calendars, and a privacy review queue can stall a flu shot reminder or a new service launch. If reviews take weeks, teams will route around them.

The answer is tiering. Common, pre-approved patterns get a fast track: a standard reminder template with standard fields and a known vendor. Full review is reserved for new vendors, new fields or new service lines. Most requests then clear in days, and the review effort goes where the risk is.

How to engage with less exposure

The best protection is to hold less. Most outreach does not need date of birth, full address and service location in the same file. A reminder needs a name, a contact channel, a time and a place. A survey needs an identifier and a contact channel. Sending the minimum fields for each use case, a principle known as data minimization, reduces what any one store can leak.

Several design choices help further:

• Tokenized identifiers. A token is a stand-in code that means nothing outside the health system. The vendor can send messages using the token without ever holding the medical record number.
• Short retention, enforced by automated deletion. Files in staging areas should be deleted automatically after they have been used, so stores cannot accumulate years of history.
• Pointing patients to the portal. A message can say “you have an upcoming appointment; log in for details” rather than placing the time, place and department in the email itself.

Each choice has a cost: more integration work, less personalized messages, slightly lower response rates. Patient experience leaders should weigh those costs with privacy officers rather than alone. Neither side should win by default.

The trade-off runs in both directions. Patient engagement is valuable, and over-restricting it pushes teams toward unsanctioned tools, such as a free survey service or a spreadsheet emailed to a vendor. A health system that gives engagement teams an approved, well-governed platform with clear data rules is likely to end up with fewer stray copies than one that simply says no.

How tokenization works, and its limits

Tokenization replaces the medical record number with a random code. The health system keeps the table linking codes to patients. The vendor receives only the code, a name and a contact channel. When a patient replies or a message bounces, the vendor reports back by code, and the health system translates.

The technique has limits worth stating honestly. Being on a particular hospital’s mailing list is itself revealing, so a tokenized list still contains PHI. Vendors also lose some features, such as removing duplicates across campaigns or personalizing by visit history. Tokens shrink the damage a stolen list can do. They do not make it harmless.

Controls on the staging store

Encryption at rest is standard and worth having. It does little, however, against an attacker who uses valid credentials, which is how many cloud storage thefts happen. The controls that matter more are about access.

• Short-lived credentials that expire in hours rather than keys that last for years.
• Network restrictions so the store accepts connections only from known systems.
• Access logging sent to the security team’s monitoring, with alerts on bulk downloads.
• Customer ownership of the storage account where possible, so the health system sets the rules and sees the logs.

Designing messages that are harder to fake

A stolen outreach list is a phishing kit. Health systems can make imitation harder in two ways. First, they can keep message content generic, with subject lines and bodies that do not name departments or conditions.

Second, they can authenticate their sending domains with SPF, DKIM and DMARC. These are email standards that let receiving mail systems verify a message really came from the domain it claims. Major mailbox providers began requiring them of bulk senders in 2024. A consistent sending domain also lets a health system tell patients plainly which addresses it uses, and which it never uses.

Testing the cost of privacy

Less detail in messages may reduce response rates, and missed appointments cost money and care. The right response is to measure rather than guess. A health system can test a minimized reminder against its current one on a sample of clinics and compare no-show rates. If the minimized version performs nearly as well, the decision becomes easy. If it performs worse, the trade-off is at least visible and can be decided on evidence.

Drawing the map before it is needed

A well-run health system can draw a map of every place patient data travels for outreach, and every stop on that map has an owner, a contract and a deletion rule. New flows are reviewed before they go live. Outreach systems appear in the HIPAA risk analysis alongside clinical ones. Vendors are asked about their own subcontractors. And engagement teams have a sanctioned platform that makes the safe path the easy one.

The map also pays off on the worst day. When a list of patient data surfaces somewhere it should not, a prepared health system can compare it against its map of outreach flows. That narrows down the likely source quickly. That matters, because the speed and accuracy of the first public statement shape how patients, regulators and the press judge everything that follows. An organization that has to start by asking “which of our systems even holds data like this?” loses days it cannot get back, and risks saying something early that later turns out to be wrong.

Where health systems go wrong:

• Classifying by field instead of by record. No clinical field does not mean no health information.
• Inventorying applications instead of data flows. The staging bucket is not an application, so it never appears on the list.
• Keeping everything. Storage is cheap; breaches are not.
• Contracting with the first vendor only. The email delivery service behind it may hold the same data with no agreement.
• Saying no. Blocking engagement without offering an alternative drives teams to shadow tools.

What a row on the map contains

The map does not need special software to start. A shared spreadsheet works, provided each row records the same facts.

• The source system and the job that extracts the data.
• The exact fields sent, and the purpose of each.
• The destination, including the storage account that holds files in transit.
• The vendor, its subcontractors and the agreements that cover each.
• The retention period and how deletion is enforced.
• The type of credential used and when it was last rotated.
• The business owner, the security contact and the date of the last review.

Once the spreadsheet stabilizes, many organizations move it into a data catalog or lineage tool that updates automatically. Either way, the map is only useful while it is current. Tying its review to contract renewals and to the annual risk analysis keeps it from going stale.

Using the map during an incident

When a list surfaces, the first task is attribution. Each outreach feed tends to have its own fingerprint: a particular set of fields, a column order, a date format, a population. Comparing a leaked sample against the documented fields of each feed often narrows the source to one or two candidates within hours.

Some organizations go further with seeded records. These are a small number of synthetic patient entries, unique to each vendor feed, that exist nowhere else. If a seeded entry appears in a leaked list, the source is identified. Direct mail firms have used the same technique for decades to detect misuse of their lists. It costs little to set up, and on the worst day it can save days of uncertainty.

Checking your own outreach stack

• Can we list every flow of patient data out of the EHR and data warehouse to reminder, survey, marketing and messaging vendors, including staging storage?
• Does each outreach system have a named business owner and security contact, and who approves a new outreach data flow before it goes live?
• Which vendors and subcontractors hold our patients’ contact and appointment data, and do we have agreements with all of them?
• How long do staging stores keep files, and is deletion automatic?
• If a list of our patients appeared for sale tomorrow, how quickly could we tell where it came from?

The electronic health record will rightly remain the most protected system in any hospital. HCA’s experience is a reminder that patients’ privacy also travels through the less glamorous systems around it.

With hindsight

HCA’s incident was among the largest healthcare breaches reported in 2023. Its scale made it hard to dismiss as a technicality, and its source made it instructive: not a hospital’s clinical core, but a storage location in the communications machinery around it.

The year as a whole was severe. When HHS later proposed changes to the HIPAA Security Rule, it noted that more than 160 million individuals were affected in 2023 by breaches involving 500 or more people. The same proposal said reports of such large breaches had doubled between 2018 and 2023. HCA’s list was one large entry in a very bad year.

It arrived while regulators were already pressing hospitals and telehealth providers over tracking technologies on websites and apps. These are small pieces of code, often supplied by advertising and analytics companies, that record what visitors do on a page and send that information to third parties. On a hospital website, that can mean revealing that a particular visitor looked up a particular condition or booked with a particular clinic.

That concern produced its own large disclosures. In April 2024 Kaiser Permanente began notifying about 13.4 million current and former members that tracking code on its websites and apps may have sent information to third-party advertisers. Again, the exposure ran through engagement technology rather than the clinical record.

In June 2024 a federal court in Texas vacated part of HHS’s guidance on online tracking, the part covering unauthenticated public web pages, meaning pages anyone can see without logging in. Litigation and state enforcement over tracking continued regardless. The legal boundaries shifted, but the underlying concern about patient data leaking through marketing and analytics tools did not go away.

States widened the net from another direction. Washington’s My Health My Data Act, which took effect for most regulated entities on March 31, 2024, covers consumer health data that HIPAA does not. It gives individuals a private right of action. Hospitals’ HIPAA-covered records largely fall outside it. But wellness programs, apps and marketing data held outside HIPAA do not, which made the classification question harder to wave away.

The largest breach of the period confirmed the wider pattern. In February 2024 a ransomware attack hit Change Healthcare, the UnitedHealth Group unit that processes claims and payments for much of American healthcare. UnitedHealth later put the number of people affected at roughly 190 million. Once again the damage came from a system that moves data between organizations, not from a hospital’s chart.

Together these episodes moved attention from the EHR as the only crown jewel to the systems around the patient: marketing, analytics, engagement and communications. For many health systems, these were the systems that had grown fastest, with the least central oversight, because they were bought to solve business problems rather than clinical ones.

Regulators moved toward the same view. The HIPAA Security Rule changes HHS proposed in January 2025 would require regulated entities to inventory their technology assets and map the movement of electronic PHI through their information systems. Such an inventory comes close to the outreach map this article argues for. Whatever form the final rule takes, the proposal showed where the regulator’s expectations were heading.

What held up best was the classification argument. A record that links a person to a care event is health information, whatever its fields. What remains harder to judge is how far the industry has acted on it, because outreach inventories are internal and rarely published.

The HCA case remains a clear example of the risk that lies there: data that nobody had classified as sensitive, held outside the controls built for the record. The practical step is to ask where patient data goes once it leaves the clinical system, and to make sure every stop along the way has an owner, a contract and an expiry date.