SAN ANTONIO — Jay Juarez received two concerning calls on Tuesday. A man called from a local number, and knew both Juarez's name and some of his recent medical history, but wouldn't tell Juarez exactly where he was calling from.
"I said 'I don't know who you are and I don't know how you have my healthcare information,'" Juarez told KENS 5. "The reply was, 'we are the diabetes department.' I'm like, 'you are going to have to try harder than that.'"
Juarez tried to be polite but eventually hung up. The same individual then called him back 15 minutes later from another, likely spoofed, number. Juarez was then less polite.
"The second phone call wasn't a good one for them," Juarez said. "I didn't get any more calls after that."
Still, much of the information the caller had was accurate. Juarez didn't know exactly what was going on until he got a work email on Friday. That's when his employer's IT contractor informed him that his email, and some other information, had been found on the "dark web."
The source, said "HCA Healthcare." It's the same company that has had 11 million patient records exposed across 20 states.
Juarez later reviewed this list (scroll down to Texas) and discovered it included CareNow Urgent Care locations in Texas along with many other hospitals, specialists and clinics. He had visited a CareNow location just a few months before.
Juarez now hopes others in San Antonio review that same list and see if any of their health care professionals, or hospitals, are listed.
"People need to be aware that they have to protect themselves and look into this and make sure that their information is safe," Juarez said.
Juarez also said HCA Healthcare never notified him of the breach. He said he called HCA Healthcare Friday and was simply told he would be given a call back.
"I got routed to their ethics line. I filed a detailed complaint and they gave me a case number. The representative was not aware of the hack," Juarez said. "Even that is a concern."
The HCA Healthcare site states, "HCA Healthcare will offer credit monitoring and identity protection services, where appropriate. In the meantime, we encourage patients to remain vigilant in identifying calls, emails or SMS texts which appear to be spam or fraudulent. Additionally, patients should never open links or attachments sent from untrusted sources."
The site also states, "Beginning Monday, July 17, 2023 patients can call us at (888) 993-0010 to ask any general questions and to confirm the legitimacy of any communication from anyone claiming to be affiliated with HCA Healthcare."
Juarez said he will likely not wait for a response and will look at other identity theft protection options.