The company, called HCA, was found to have violated state-level consumer protection laws and possibly federal consumer financial protection laws.