For roughly six months, a Premise Health employee pulled patient data out of the company, and the theft went unnoticed until September.
The Brentwood, Tennessee provider runs more than 800 workplace wellness centers in 46 states and Guam. It identified the copying on September 18, 2026, and traced the activity back to March 26. Access was revoked immediately, security controls were revalidated, and law enforcement was notified. The worker has been terminated.
Copied records included names, addresses, dates of birth, Social Security numbers and insurance details, along with diagnostic and treatment information. Premise says it has no evidence of misuse. Preliminary analysis results arrived October 14 and notices have since gone out.
Counts are still partial: more than 66,000 people in South Carolina and nearly 2,000 in Vermont, with no national total published.
Two more disclosures in the same batch
Telecare Corporation, a California behavioral health operator, also disclosed an incident. Separately, Enara Health, a weight management clinic group, reported one.
The common thread is the quiet, credentialed kind of loss. No malware, no leak site, no ransom note – just an account with legitimate entitlements moving records at normal business hours. Insider cases routinely stay hidden longest because every action looks authorized to the logs.
Detection guidance follows: baseline how many records each role exports, alert on bulk access by departing staff, and gate PHI export behind a second approval. Premise’s own timeline – a six-month blind spot before a compliance sweep caught it – is the argument for behavioral analytics over access reviews alone.
