HCA Healthcare
Health Care
63
out of 100. Number 96 of 512, counting from the worst.
Where HCA Healthcare does well
- Renewals 2 of 20. Few problems found.
- Their CCPA disclosure chart is unusually candid: most categories — identifiers, medical/insurance information, protected characteristics, commercial info — are marked 'Sold or Shared: No'; only browsing-activity data and coarse geolocation are shared for advertising.
- They honor Global Privacy Control opt-out preference signals as valid opt-outs of sale/sharing — more than many companies do — and offer a real consumer request form plus a phone line (844-422-3282) for CCPA/CPRA rights.
- HIPAA-covered health information is explicitly carved out of the portal privacy policy and governed by the separate Notice of Privacy Practices instead.
- The Text Message Terms state 'You do not need to provide this consent in order to purchase any products or services' and provide a reply-STOP opt-out.
- The privacy policy promises 'reasonable means to notify you in writing prior to' privacy-policy changes taking effect — notably better than the Terms' no-notice change clause.
- They collect only region/postal code, not precise GPS location.
If you have any dispute with HCA about its websites, patient portals, or text-message services, you cannot sue in court, join a class action, or get a jury — you must go through private binding arbitration before THREE arbitrators in Nashville, Tennessee (a far more expensive setup than a standard single arbitrator), you split the AAA fees 50/50 with a Fortune 500 company, you pay your own lawyers no matter what, and even if you win the arbitrators cannot award punitive damages.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
If you have any dispute with HCA about its websites, patient portals, or text-message services, you cannot sue in court, join a class action, or get a jury — you must go through private binding arbitration before THREE arbitrators in Nashville, Tennessee (a far more expensive setup than a standard single arbitrator), you split the AAA fees 50/50 with a Fortune 500 company, you pay your own lawyers no matter what, and even if you win the arbitrators cannot award punitive damages.
You agree that any dispute arising out of or relating in any way to your use of the Services requires that the claim be resolved exclusively by confidential binding arbitration... The arbitration shall be conducted before three neutral arbitrators in Davidson County, Tennessee, U.S.A., in accordance with the rules of the American Arbitration Association ('AAA')... No claims of any other parties may be joined or otherwise combined in the arbitration proceeding. Unless otherwise expressly required by applicable law, each party shall bear its own attorneys' fees... The parties shall equally share all AAA charges and fees associated with the arbitration. BECAUSE THE USE OF THE SITE REQUIRES THE ARBITRATION OF ANY CLAIMS OR DISPUTES EXISTING BETWEEN THE PARTIES, NEITHER PARTY WILL HAVE THE RIGHT TO PURSUE THAT CLAIM IN COURT OR BEFORE A JUDGE OR JURY OR TO PARTICIPATE IN A CLASS ACTION OR ANY OTHER COLLECTIVE OR REPRESENTATIVE PROCEEDING. THE ARBITRATORS' DECISION WILL BE FINAL AND BINDING.
-
No matter how much harm HCA's site, portal, or services cause you, $100 is the maximum you can ever recover — and you have only 12 months to file a claim, even in states where the law normally gives you 2-6 years.
IN NO EVENT SHALL OUR LIABILITY TO YOU RELATING TO OUR SERVICES (OR ANY PART THEREOF) EXCEED ONE HUNDRED DOLLARS ($100). ... You agree that any claim, dispute, or cause of action arising out of these Terms or your use of the Services must be filed within one (1) year after the claim or cause of action arose or it shall forever be barred, notwithstanding any statute of limitations or other law to the contrary.
-
HCA can rewrite the terms whenever it wants and doesn't have to tell you — your next visit to the site or portal counts as agreeing to the new rules, and your only option if you disagree is to stop using their digital services entirely.
We reserve the right to revise and update these Terms at any time without notifying you. As such, please periodically review these Terms... Continued usage of our Services will be considered acceptance of any changes. If you object to any provision of these Terms or any subsequent modifications to these Terms, your only recourse is to immediately terminate your use of the Services.
-
On a healthcare company's patient-portal site, HCA runs Google, X, and Facebook ad-tech with remarketing, shares your browsing activity and location with ad partners, and explicitly ignores Do Not Track signals — your behavior across their health sites feeds targeted advertising.
We use Google Ads, the Google Marketing Platform and related marketing and advertising services provided by Google, LLC in connection with our Site and general corporate advertising and marketing operations for purposes of, among other things, online advertising, which includes remarketing, re-engagement, or similar audience and advertising and marketing features. ... We use X Ads... We use Facebook Ads and related services provided by Facebook, Inc. in connection with our Site to run advertising and marketing campaigns on Facebook. ... We do not honor Do Not Track (DNT) requests. ... To Partners. We may share information with marketing, treatment or health care operations support partners required to protect the confidentiality of your information that will enable them to send you targeted messages or serve you targeted advertising...
-
By default HCA holds your portal data for about 5 years, but your MyHealthONE account — the gateway to your medical records — is never auto-deleted and can persist indefinitely until you specifically ask for deletion.
We will retain Personal Information for the period necessary to fulfill the purposes for which it has been collected... we dispose of all categories of Personal Information no later than 5 years from the date of collection unless a longer retention period is required by law... Consumer accounts in the MyHealthOne Portal are only deleted at the request of the Consumer and may exceed the five-year retention period. Information collected from a 'Contact Us' webform may exceed the five-year retention period...
-
Hand your phone number to your doctor and later change numbers without instantly telling the hospital, and if appointment texts hit your old number, YOU owe HCA and its texting vendors full compensation for any resulting federal robocall (TCPA) lawsuit — a hospital shifting its own texting liability onto patients.
You agree to indemnify us and any third parties texting on its behalf in full for all claims, expenses, and damages related to or caused, in whole or in part, by your failure to immediately notify us if you change your telephone number, including but not limited to all claims, expenses, and damages related to or arising under the Telephone Consumer Protection Act.
How these were found
Documents actually read: (1) HCA Terms of Use, 'Updated as of October 18, 2022,' read in full at https://www.tristarmedgroup.com/legal/terms-of-use (TriStar Medical Group, an HCA Healthcare affiliate; the document itself states it applies to 'HCA Healthcare, Inc. and/or any of its affiliates,' and https://www.hcahealthcare.com/legal links to the same 'Terms of use'). Nearly 4 years old; the live hcahealthcare.com version may have since changed. (2) MyHealthONE Privacy Policy, 'Updated as of July 1, 2023,' read in full directly at https://hcahealthcare.com/myhealthone/myhealthone-privacy-policy.dot (official HCA domain) — over 3 years old. No third-party mirrors were used. Per the task scope, HIPAA-covered treatment records were not reviewed; the privacy policy itself excludes PHI (governed by the separate Notice of Privacy Practices). Google Play's data-safety disclosure for the MyHealthONE app (shares personal info/app activity with third parties; collects data linked to identity) was used only as supplementary context, not as a clause source.
These notes come from the original draft and are not independent verification.