VULNpocalypse
MediumBreach / campaignMonitoring

Premise Health discloses insider patient data theft, per HIPAA Journal

HIPAA Journal reports Premise Health says a former employee copied patient data; affected people should read any notice they receive and act on it.

Published
Exploitation
No software exploitation reported. The source describes insider copying by a former employee, and Premise Health says it has not identified any data misuse.

What happened

According to HIPAA Journal, Premise Health Holding Corp. has announced that a former employee copied patient data without authorization. This advisory rests on that single HIPAA Journal article. The sources provided contain no independent verification of Premise Health’s account.

HIPAA Journal reports that Premise Health, a Brentwood, Tennessee-based direct healthcare provider, says it identified the insider theft on September 18, 2026. According to the report, the company says the employee violated company policies and misappropriated company data starting on March 26, 2026. HIPAA Journal says the employee’s credentials were revoked immediately, security controls were validated and an investigation was launched. The article reports that Premise Health obtained preliminary data analysis results on October 14, 2026, that the data has since been validated, and that notification letters have been mailed to the affected individuals.

Per HIPAA Journal, the copied data included names, addresses, dates of birth, government identification numbers such as Social Security numbers, health insurance information, diagnostic and treatment information, and other information provided in relation to eligibility for Premise Health services. HIPAA Journal reports that Premise Health confirmed the employee has been terminated and that law enforcement has been notified. Premise Health did not state why the data was copied and says it has not identified any data misuse. HIPAA Journal says the total number of affected individuals has not been publicly disclosed, although the incident is known to have affected more than 66,000 people in South Carolina and almost 2,000 in Vermont.

The same article also reports two other incidents:

  • Telecare Corporation (Alameda, California): HIPAA Journal reports that Telecare says it first identified a data security incident on January 25, 2026, and confirmed unauthorized network access. Per the article, its data review was completed on September 4, 2026, and the data involved varied by individual. Telecare says no misuse has been identified and that affected individuals have been offered complimentary credit monitoring and identity theft protection. The number affected is not disclosed.
  • Enara Health, Inc.: HIPAA Journal reports that Enara says it started notifying individuals on November 6, 2026, about an incident first identified on September 10, 2026. Per the report, its forensic investigation determined that an unauthorized third party accessed its provider application on September 10, 2026, and that data within it was copied. Enara says its network and other systems remained secure. The number affected is not disclosed.

Am I affected?

Not confirmed for any individual reader. The source gives no lookup tool.

  • Premise Health: possibly affected if you are a patient or were eligible for its services, and you received a letter. HIPAA Journal reports that Premise Health has mailed notification letters to affected individuals. The total number affected is not confirmed. The figures for South Carolina and Vermont are the only ones reported.
  • Telecare Corporation: the article says affected data varied by person. It says affected individuals have been offered credit monitoring and identity theft protection, but does not mention letters. The number affected is not confirmed.
  • Enara Health: the article says Enara started notifying individuals on November 6, 2026, and that affected data varied by person and included limited self-reported medical information. The number affected is not confirmed.

No CVE or software vulnerability is mentioned in the source.

What to do now

  1. Watch for a notice from Premise Health or Enara Health, and read which data types it lists for you.
  2. If you are contacted by Telecare Corporation about credit monitoring or identity theft protection, which HIPAA Journal reports Telecare has offered to affected individuals, follow the enrollment instructions you are given.
  3. Use the contact details in any notice you receive if you have questions. The source does not provide separate hotlines or dedicated pages.
  4. Organizations that handle patient data may take note that the Premise Health incident, as reported, involved a former employee. The source does not state which controls would have prevented it.

Sources