HCA Healthcare runs 190 hospitals and more than 2,400 other facilities across 19 U.S. states and England. Every time a patient walks in for surgery, an emergency room visit, a mental health stay, or a routine outpatient procedure, HCA bills for that service. The company collects from Medicare, Medicaid, private insurance companies, and patients directly. About 48.9% of revenue in 2025 came from managed care and private insurers, while Medicare and Medicaid programs together accounted for roughly 45.4%. HCA does not make a product. It earns money each time it delivers care, at each of its physical locations. The diagram below traces where the money goes.
How HCA Healthcare Makes Money
flowchart TD
A["190 Hospitals
179 acute care
7 behavioral
4 rehabilitation"] --> B["Patient Services
Inpatient & outpatient"]
C["121 Surgery Centers
31 Endoscopy Centers"] --> B
B --> D["Revenue by Payer
75.6B total 2025"]
D -->|"Medicare 14.9%
11.3B"| E["Medicare Reimbursement
MS-DRG prospective payment"]
D -->|"Managed Medicare 17.8%
13.4B"| F["Managed Care Plans
Private & exchange"]
D -->|"Medicaid & Managed
12.7%"| G["Government Programs
State & federal"]
D -->|"Direct patient 3.2%
2.5B"| H["Uninsured & out-of-pocket"]
E --> I["Operating Cash Flow
12.6B 2025"]
F --> I
G --> I
H --> I
I --> J["Reinvestment in
Facilities & Technology"]
J --> A
J --> C
I --> K["Debt Service
45.5B net debt"]
K --> I
Five years of financial data tell a clear story of steady growth. Revenue climbed from $58.8 billion in 2021 to $75.6 billion in 2025. That is not just inflation. Admissions rose 2.7% in 2025 alone, and revenue per admission also went up 4.0% that same year. Both the number of patients and the amount collected per patient increased together.
HCA Revenue 2021 to 2025 ($B)
Revenue has grown every year for five consecutive years, rising $16.8 billion in total from 2021 to 2025.
Cash generation improved even faster than revenue. Cash from operations was $9.0 billion in 2021 and jumped to $12.6 billion by 2025. Free cash flow, the money left after spending on upkeep and expansion of facilities, rose from $5.4 billion in 2021 to $7.7 billion in 2025. That is a meaningful improvement in the actual cash the business produces.
$7.7B
Free cash flow in 2025, up from $5.4B in 2021
But there is a significant weight on the other side of the ledger. Debt has grown every single year alongside the business. Net debt stood at $33.1 billion in 2021 and reached $45.5 billion by the end of 2025. Total debt on the balance sheet at December 31, 2025 was $46.5 billion. Interest expense in 2025 was $2.248 billion, up from $2.061 billion the year before, and the increase came primarily from a higher average debt balance. The business generates strong cash, but a large portion of it services debt.
$45.5B
Net debt at end of 2025, up from $33.1B in 2021
What is Medicare and Medicaid reimbursement?
Medicare is a federal program that pays hospital bills for people aged 65 and over, some disabled people, and certain patients with specific diseases. Medicaid is a joint federal and state program that covers low-income individuals. Both programs pay hospitals fixed rates that are generally lower than what private insurers pay. When these rates get cut, hospitals receive less money for the same care they provided before.
The government is a critical but complicated payer for HCA. Medicare and Medicaid together represented 45.4% of HCA's revenues in 2025. Congress has already mandated automatic 2% cuts to Medicare payments that run through the first five months of 2033. The Fiscal Responsibility Act is also expected to reduce Medicaid funding, particularly in Texas, where HCA operates 55 hospitals and where those facilities generated $20.962 billion in revenue in 2025. Florida and Texas combined produced 51% of HCA's total revenue in 2025. Concentration in two states creates real exposure when either state changes its Medicaid rules.
2020
milestone
HCA Acquires Galen College of Nursing
In 2020, HCA bought most of Galen College of Nursing, which operates 21 campuses across 12 states. This move addressed one of the company's most persistent threats: not having enough trained nurses to staff its hospitals. By owning nursing schools, HCA builds part of its own workforce pipeline rather than competing entirely in the open labor market.
Labor is the other major risk. HCA depends on nurses, doctors, and medical staff to run every single one of its hospitals. Shortages of experienced nurses push up wages. Some states require minimum nurse-to-patient staffing ratios, which limits flexibility. Union activity can raise costs further. HCA is also rolling out a new electronic health record system across all its facilities. If that rollout runs into problems, it could disrupt patient care and require additional spending beyond what is already planned.
What is a cybersecurity risk for a hospital?
Hospitals store highly sensitive patient health data and run critical systems like drug dispensing and patient monitoring online. Ransomware attacks lock down these systems until a payment is made. A successful attack could stop patient care, leak private data, and cost the hospital enormous sums to fix. Healthcare providers are a frequent target of these attacks.
Cybersecurity is a high-severity risk in HCA's own filings. The company stores sensitive patient data and runs critical hospital systems online. Ransomware groups and nation-state hackers actively target healthcare providers. A successful breach could disrupt patient care, trigger lawsuits, damage HCA's reputation, and require expensive remediation. HCA also operates with heavy concentration in Florida and Texas, two states prone to hurricanes. Hurricanes Helene and Milton alone caused an estimated $250 million in losses in 2024.
HCA's uninsured admissions in Florida and Texas represented 73% of all its uninsured admissions in 2025. Patients who cannot pay are disproportionately concentrated in the same two states that generate the majority of revenue.
$38.8B
Florida + Texas revenue (2025)
51%
Share of total revenue
More than half of HCA's total revenue comes from just two states, making the company sensitive to regulatory and weather events in those markets.
$2.248B
Interest expense in 2025, up $187M from 2024
The Bet
HCA keeps growing revenue and cash flow faster than its debt load grows and faster than government reimbursement rates get cut. The company collects 45.4% of its revenue from Medicare and Medicaid programs that are already under mandated payment reductions extending to 2033. If those cuts deepen, or if Medicaid funding in Texas contracts sharply, the revenue base that supports $46.5 billion in debt becomes harder to maintain. The whole financial structure works only as long as patient volumes keep rising, private insurers keep paying more per visit, and labor costs do not outpace the revenue gains that offset government payment pressure.
Open question
HCA has grown revenue for five straight years, improved free cash flow from $5.4 billion to $7.7 billion, and built one of the largest hospital networks in the country. At the same time, its debt has risen every year, the federal government is cutting Medicare payments through 2033, Medicaid funding in its biggest state faces structural changes, and its two core states generate 73% of its uninsured patient burden. Can HCA grow admissions and revenue per patient quickly enough to absorb rising debt costs, government payment cuts, and labor pressure simultaneously, or does the concentration of risk in Florida and Texas eventually become the ceiling on how much the business can grow?
Compiled · 10-K · FY2025
Indebtedness
The company has $46.492 billion in debt as of December 31, 2025. If the company cannot generate enough cash to pay back this debt or refinance it on good terms, it may be forced to sell assets, reduce investments in hospitals and equipment, or restructure the debt, which could seriously harm the business.
Government Reimbursement
The company received 45.4% of its revenues from Medicare and Medicaid in 2025. Congress has mandated automatic 2% cuts to Medicare payments through 2033, and the Fiscal Responsibility Act includes significant changes to Medicaid funding and payment structures that are expected to reduce revenues, particularly in states like Texas where the company operates.
Cybersecurity and Data Breaches
The company stores sensitive patient health information and operates critical hospital systems online. Despite security measures, ransomware groups, nation-state actors and other hackers continue to target healthcare providers. A successful attack could disrupt patient care, cause data loss, trigger lawsuits, damage reputation, and require expensive remediation.
Healthcare Workforce
The company depends on nurses, physicians and other medical staff to operate hospitals. Shortages of experienced nurses and healthcare workers, combined with union organizing activity and higher wage demands, increase labor costs. Some states require minimum nurse staffing ratios, and physicians can move to competing hospitals, threatening the company's ability to maintain operations and control costs.
EHR Implementation
The company is implementing a new electronic health record system across all its facilities, which is complex and time-consuming. If the rollout is delayed or encounters problems, it could disrupt patient care, require substantial additional spending, and divert management attention from other priorities.
10-K Item 1A · Risk Factors
