After fainting on the job with a low hemoglobin count in early January 2021, Lenna Ray, then 67, went to HCA Florida Citrus Hospital in Inverness, Florida, for care. Ray was moved to a private room in the emergency department where, over the next four hours, Hiram Bonilla, a male nurse, repeatedly sexually assaulted her, court and police records show.

“He was putting stickers on my chest for an EKG and he said, ‘You got pretty titties,’” Ray recalled in an interview with NBC News. “By the time he finished that statement, he was on me.”

Hospital video reviewed by NBC News shows Bonilla entered Ray’s room 28 times over those four hours, every nine minutes on average.

Heavily medicated, Ray told hospital staff what Bonilla had done, but they pooh-poohed her, she testified, with one staffer telling her Bonilla was “a very good man” and “would never do” what she’d accused him of, court records show.

Ray called her longtime therapist from the hospital and told her about the incidents. The therapist then notified a local center that helps sexual abuse victims. At 2:15 a.m. on Jan. 6, the abuse center notified Citrus Hospital of Bonilla’s alleged assaults, court documents show. It then took almost six hours for the hospital to alert police to the allegations.

When a detective arrived at the hospital to interview Ray, he found the crime scene altered, he testified. Critical evidence, such as bed sheets and a pillowcase, were gone from her room.

In 2022, Bonilla, 60, was found guilty of sexual assault in the incident and is serving a 20-year sentence. Ray sued the hospital for negligence, and in September a jury awarded her $25 million. About a month later, she entered into a confidential settlement with the hospital, her lawyer, Gregory Roe, said.

“Hospital protocol on sexual assault is not written with the patient in mind,” Roe said in an interview before the settlement. “It’s designed to protect the profits.”

Citrus Hospital is owned by HCA Healthcare, the nation’s largest hospital chain. HCA has 187 hospitals nationwide and in the U.K., and 46 in Florida alone. The company earned $4.3 billion during the first three quarters of 2024. Those results were 19% higher than the same period in 2023; HCA’s stock trades at $333, up 21% year to date.

Ray’s repeated abuse at HCA’s Citrus Hospital occurred four months after another male nurse, Mark Miskar, sexually assaulted a patient there, police records show. Miskar is currently serving a 65-month sentence for sexual battery in that incident.

Katie Myers, a Citrus spokeswoman, declined to answer detailed questions about the recent assaults at the facility. She provided a statement saying that Ray experienced “terrible pain” in the Bonilla assault and “our hearts go out to her.”

“We have protocols designed to protect our patients and expect our employees to follow them, as well as applicable laws,” Myers added. “The heinous and criminal acts of an individual do not represent the commitment of our hospital colleagues to the care and safety of their patients.”

Insufficient staffing, indiscriminate hiring practices, training failures, “tolerance of unacceptable behavior” and “not holding their staff members accountable” can imperil patients, the foundation said. “The setting itself can also contribute to patient abuse.”

HCA Florida Citrus Hospital had a policy for identifying, investigating and reporting patient allegations of sexual misconduct or abuse by a health care worker when Ray was attacked in early 2021.

Dated November 2020 and produced in her lawsuit, the policy says it aims “to ensure our patients are free from abuse” and lists 26 actions hospital officials should take when an allegation of sexual misconduct arises.

The first is to ensure the patient is safe; then, the hospital’s executives are to be notified along with the patient’s family or representative. Hospital officials are directed to complete an incident report, take the patient’s statement as well as those of witnesses, pull surveillance video and offer the patient a rape crisis hotline number.

More than halfway through the checklist — item 14 — is immediate suspension of the accused worker. Item 18 directs officials to alert the hospital’s marketing department, “in case of any social media or media attention.”

Item 19, almost three-quarters through the checklist, states: “notify law enforcement.”

Myers, the Citrus spokeswoman, said the checklist “is not in order of prioritization.” The Citrus policy was identical to that of HCA Florida Fawcett Hospital in Port Charlotte, 160 miles to the south. It was dated 2022 and also produced in Ray’s case.

Both policies contrast with that of Veterans Affairs hospitals nationwide, overseen by the U.S. government. Step one in VA hospitals’ sexual assault protocol involves providing “non-judgmental acknowledgement of incident,” noting important details and contacting VA police or local law enforcement.

Harlow Sumerford, a spokesman for HCA Healthcare, declined to provide a written corporate policy on handling sexual assault allegations in its facilities.

Instead, he provided a statement saying HCA requires employees to complete training on the company’s “standards of integrity and ethical behavior and compliance with laws and regulations. That includes an understanding that there is zero tolerance for any type of sexual misconduct.”

His statement added: “It is our expectation that any incident that threatens the safety of a patient be reported promptly and investigated thoroughly so that any appropriate action can be taken, including suspension and/or termination of employment.”

If an HCA hospital’s reporting and investigation fails to meet those expectations, he added, the company takes corrective action, such as disciplinary action or requiring additional training.

“Our hearts go out to anyone who is the victim of a crime, and we support and appreciate the work of law enforcement and the judicial system to punish individuals who have committed crimes,” he said.

Frustrated law enforcement officials

For four years, detective Ryan Brown had worked in the special victims unit of the Citrus County Sheriff’s Office investigating sex crimes. A 10-year veteran of the U.S. Marine Corps., Brown and a registered sexual assault examination nurse were assigned to Ray’s case. Both found Ray’s description of the repeated assaults credible, he testified.

Brown was troubled by some of the hospital’s actions in Ray’s case, according to his testimony. First, Brown said, the crime scene had been altered. Then, facility officials tried to sit in on his interview with Ray — a problem, he said, “because patients aren’t going to divulge, or victims aren’t going to divulge information because they’re afraid.”

Brown and the examination nurse had to ask the hospital officials to leave, he recalled. In addition, hospital staffers had shuttled Ray from room to room after the assaults, a disorienting experience for someone who had just experienced a trauma.

“I hope to God that if somebody were to do this to a family member of mine,” Brown testified, “that they would have been treated with a little bit more respect than what was treated there.”

Myers, the Citrus spokeswoman, declined to comment on Brown’s testimony. “The facility worked with law enforcement to ensure that the individual responsible for that crime was convicted,” she said in a statement.

Michelle Simpson Tuegel is a lawyer who has represented sexual assault victims of Larry Nassar, the former USA Gymnastics coach, and George Tyndall, the University of Southern California gynecologist. Regarding hospital assaults, she said: “Institutions can’t just pass the buck. They have to do things that protect the patient in the interim. People can abuse as long as we let them.”

Deficiency reports

To ensure that hospitals comply with federal and state health care rules, regulators make surprise visits to facilities in which they interview staff and review files. During these visits, regulators sometimes uncover violations that have not been reported to authorities as required, including patient allegations of sexual misconduct. The regulators file deficiency reports outlining the failings, such as the two incidents reported at Citrus Hospital in 2018.

NBC News reviewed hundreds of pages of deficiency reports dating back to 2019 at 32 hospitals in the Gulf Coast region of Florida where Citrus operates. Half of the hospitals reviewed were HCA facilities in its West Florida division and the other 16 were operated by HCA competitors, both nonprofit and for-profit entities.

Reports on the 32 facilities showed regulators uncovered three unreported incidents of sexual misconduct during the almost five-year period. Two were at HCA hospitals and one was at a facility operated by nonprofit BayCare Health System.

In one 2020 report involving HCA Florida West Tampa Hospital, the mother of a patient alleged her child had been molested. The hospital told regulators it had conducted an investigation into the incident, the report shows.

But the regulators found no documentation of hospital employees interviewed, no interview details and no documentation of a videotape review.

Further inquiry by regulators found that an Adult Protective Services investigator had requested information on a male employee who was interviewed. He had denied wrongdoing but was suspended, the report noted. Documentation revealed the hospital subsequently fired the employee.

West Tampa Hospital did not return an email seeking comment, and HCA did not comment on the report.

A Florida state regulatory report from 2019 involving BayCare’s Morton Plant Hospital found four patients had complained of inappropriate touching by staff and another patient had complained of inappropriate comments by a worker.

There was no evidence the facility notified the state Department of Health or its administrator of the incidents, the report noted, even though such notifications are the hospital’s policy.

The hospital’s risk manager told investigators: “The facility does not report allegations of sexual misconduct to the DOH unless, through their own investigation, they determine there was sexual misconduct.”

Mary Marandi, a spokeswoman for BayCare Health System, said in a statement that after the deficiency findings, the system decided that all allegations should be shared with the Department of Health and the hospital changed its process.

If patients want to press charges, the hospital facilitates a call to the appropriate law enforcement agency, she added. BayCare is committed to the safety of every patient, Marandi’s statement said.

‘Crime of escalation’

In March 2015, Brianna Hammer was admitted with suspected food poisoning to Cape Coral Hospital, a 303-bed facility near Fort Myers Florida, operated by nonprofit Lee Memorial Health System, court records show.

While there, Jeovanni Hechavarria, a registered nurse at the facility, sexually assaulted her, Hammer alleged. She described the assault to hospital management and filed a police report, the records show, but no evidence was collected and the hospital’s risk manager determined Hammer’s accusations were not credible.

Hechavarria kept his job at the facility. A subsequent police investigation concluded that “something happened” with Hammer and referred the matter to local prosecutors, who opened an investigation, court records show.

Just over a year later, Julie Love was admitted to Cape Coral Hospital for pancreatitis, court records show. On April 17, 2016, Hechavarria sexually assaulted her after administering narcotic pain medication, according to a lawsuit Love later filed against the nurse and Cape Coral.

In July 2016, a third Cape Coral patient, Donia Goines, alleged that Hechavarria raped her. Four months later, Hechavarria was suspended and fired. In March 2020, Hechavarria was convicted of “sexual battery while victim helpless” in the Goines case. He is in prison, records show.

All three women sued the hospital and Hechavarria, and in January 2022, the judge hearing Love’s lawsuit denied the hospital’s motion for summary judgment.

In his ruling, the judge said any failure to discipline Hechavarria, restrict his access to female patients or conduct an additional investigation into his background after the alleged assaults could weigh against the hospital.

The hospital made confidential settlements in all three cases.

Jaclyn Bevis, a spokeswoman for Cape Coral Hospital, said in a statement that the safety and well-being of patients is its highest priority.

“All of our employees undergo a thorough background screening prior to employment, which includes a national and local criminal record search,” the statement said. “On the rare occasion when a crime is alleged in our care, we support a full investigation by law enforcement, as occurred in the cases in question. The allegations against this individual are not reflective of the excellent and professional care provided in our hospitals each day.”

Ryan Fogg, a lawyer in West Palm Beach, Florida, represented Hammer and Goines in their cases against the hospital and nurse. He said he has handled eight other cases involving sexual assaults at Florida hospitals over the past five years.

Speaking generally about the facts in his cases, Fogg said the alleged attackers first get away with minor infractions, then turn more aggressive. “This is a crime of escalation,” he said. “They do a little thing, and they get away with it. Then they do a bigger thing.”

‘Not a hiring risk’

Paxton Greer was in crisis when she arrived at HCA’s Trident Medical Center in Charleston, South Carolina, on Aug. 31, 2023. After trying to end her life, Greer was heavily sedated, she told NBC News, and experiencing convulsions when Tyler Eoute, a 27-year-old medical technician, helped her into a bathroom.

He sexually assaulted her there and two more times in her hospital bed, she said. “I will never forget his face over mine,” Greer recalled, “three freckles on his cheek, and him saying, ‘Don’t worry, I am very good at what I do.’”

Greer told the hospital staff that she was being tortured, according to a lawsuit she later filed against the facility, HCA Healthcare and Eoute. “I told so many people,” Greer, 28, recalled in an interview. “I yelled: ‘He touched me! He touched me! He assaulted me!’ No one listened.”

On Sept. 2, Greer was transferred to Live Oak Mental Health and Wellness, a behavioral health facility affiliated with Trident, for about 10 days. She said she told staff there of the assaults by Eoute; no one at either facility contacted law enforcement, investigated or suspended the technician, her lawsuit states.

Before hiring a licensed clinical professional, hospitals search the National Practitioner Data Bank for information on an employee and often conduct criminal background checks. But the Greer case and other lawsuits reviewed by NBC News show some hospitals have hired employees with criminal backgrounds.

HCA Trident Medical Center hired Eoute in July 2023, even though a hospital background check found he had failed to disclose a 2022 misdemeanor conviction for domestic criminal trespass as well as several prior misdemeanor charges, including an alleged violation of a domestic violence protective order and allegedly obstructing justice.

Eoute was hired anyway, an official in HCA Human Resources Group wrote in a company document filed in the case, because “the candidate provided an explanation and documentation for failing to disclose” the conviction and charges, the HCA official wrote.

“The facility has reviewed and does not deem the candidate to be a hiring risk,” the HCA official added.

Days after Greer made her allegations to hospital officials, Eoute was still working at Trident. On Sept. 11, 2023, he assaulted a female minor brought to Trident for emergency services, according to her lawsuit. Eoute digitally penetrated her and forced her to perform oral sex on him, the suit says.

Two days later, Greer filed a police report about her assaults. A detective began investigating, and a warrant for Eoute’s arrest was issued on Oct. 16. He was arrested on Nov. 10 in California and is in jail on $1 million bond awaiting trial in both cases.

Eoute has pleaded not guilty; his lawyer did not respond to a message seeking comment.

Both women are represented by Kyle L. Ward, a lawyer in Summerville, South Carolina. “Our clients have bravely come forward with these serious allegations, and we are committed to supporting them through every step of the legal process,” Ward said. “They have endured significant trauma and seek justice in these matters.”

Rod Whiting, a spokesman for Trident Medical Center, declined to answer detailed questions about the Eoute allegations, saying in an email: “We do not tolerate behavior that jeopardizes the safety of our patients. We reported the individual to law enforcement, terminated him and assisted police with their investigation.”

Greer, now healthy, has begun advocating for others who have been assaulted in health care facilities.

“People need to know [hospitals] are hiring people when they know they have a criminal background, and they’re allowing these people to stay in these hospitals and prey on people who are vulnerable,” she told NBC News. “I’m using my voice to yell and scream as loud as I can to get something to change.”

For more on this story, tune in to NBC Nightly News with Lester Holt tonight at 6:30 p.m. ET/5:30 p.m. CT or check your local listings.