◆ HCA Healthcare is facing a growing number of lawsuits after a massive data breach exposed the personal information of 11 million patients.^[1] At least five class action lawsuits are alleging negligence in the breach, which HCA disclosed in July.^[2] The breached information was made available on an online forum, and includes: patient names, cities, states, zip codes, email addresses, telephone numbers, dates of birth, genders, service dates, locations, and next appointment dates, according to HCA’s breach disclosure. “This appears to be a theft from an external storage location exclusively used to automate the formatting of email messages,” HCA said in its statement. “The company disabled user access to the storage location as an immediate containment measure and plans to contact any impacted patients to provide additional information and support, in accordance with its legal and regulatory obligations, and will offer credit monitoring and identity protection services, where appropriate.” The class action lawsuits filed so far are in Nashville, Tennessee, Florida, Texas and California. Attorney Tricia Herzfeld represents the woman in Nashville who is suing HCA and said in an interview with a local news organization that the point of her client’s class action lawsuit is “to be able to take on a big corporation like HCA and say ‘No, we’re not going to take this and you do have obligations to safeguard our information and we’re going to band together, all 11 million of us, in this class to make sure you know that.’” HCA’s breach also has attracted the attention of at least one state attorney general: North Carolina Attorney General Josh Stein sent a letter to HCA asking for more information on the breach. Stein said he needed that information “before we know what our next steps are as a state.”^[3]