Incident Types: The types of cybersecurity incidents that have occurred include Breach and Cyber Attack.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with forensic advisers, third party assistance with threat intelligence advisers, and and recovery measures with settlement agreement (credit monitoring, cash payments), and communication strategy with public disclosure (july 10, 2023), settlement website, class action notifications, and communication strategy with settlement terms communicated via court approval (reimbursement and credit-monitoring offered)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personal Information, , Names, Addresses, Contact Information, , Patient Records, Personally Identifiable Information (Pii), , Personal Information and .

Third-Party Assistance: The company involves third-party assistance in incident response through forensic advisers, threat intelligence advisers, .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Settlement agreement (credit monitoring, cash payments).

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Class action lawsuit (settled), Class action lawsuit settled (reimbursement and credit-monitoring).

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: California Office of the Attorney GeneralDate Accessed: 2023-08-01, and Source: Top Class Actions, and Source: HCA Healthcare 2024 Annual Impact Report, and Source: HCA Healthcare Data Breach Settlement Website, and Source: US District Court for the Middle District of Tennessee (Judge Jack Zouhary).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public disclosure (July 10, 2023), settlement website, class action notifications and Settlement terms communicated via court approval (reimbursement and credit-monitoring offered).

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Settlement benefits for eligible class members (claim deadline: September 25, 2025), Eligible patients notified via settlement website and mail (free credit monitoring, cash payments up to $5,000 for documented losses), Reimbursement of up to $5 and000 for documented losses and one year of credit-monitoring services offered to class members.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Forensic Advisers, Threat Intelligence Advisers, .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Settlement Agreement, Credit Monitoring Services For Affected Patients, .

Most Recent Incident Detected: The most recent incident detected was on 2023-07-05.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2023-07-10.

Most Significant Data Compromised: The most significant data compromised in an incident were patient's name, city, state, zip code, email address, phone number, date of birth, gender, date and place of most recent service, , names, addresses, contact information, , 3.6 million patient records, Personal Information and .

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was forensic advisers, threat intelligence advisers, .

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were names, Personal Information, state, city, phone number, contact information, date of birth, date and place of most recent service, 3.6 million patient records, email address, addresses, patient's name, gender and zip code.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 14.6M.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Class action lawsuit (settled), Class action lawsuit settled (reimbursement and credit-monitoring).

Most Recent Source: The most recent source of information about an incident are HCA Healthcare 2024 Annual Impact Report, California Office of the Attorney General, US District Court for the Middle District of Tennessee (Judge Jack Zouhary), HCA Healthcare Data Breach Settlement Website and Top Class Actions.

Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing.

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Settlement benefits for eligible class members (claim deadline: September 25, 2025), .

Most Recent Customer Advisory: The most recent customer advisory issued were an Eligible patients notified via settlement website and mail (free credit monitoring, cash payments up to $5,000 for documented losses), Reimbursement of up to $5 and000 for documented losses and one year of credit-monitoring services offered to class members.