Premise Health Insider Theft Hit 68,000-Plus Patients as Three Breaches Surface

A former Premise Health employee copied patient records containing Social Security numbers for nearly seven months before detection. The misappropriation started on March 26, 2026. Premise Health identified it on September 18, 2026, according to the company's disclosure. That gap — 176 days — is the number that should worry CISOs most.

What did the insider actually take?

Premise Health, headquartered in Brentwood, Tennessee, operates more than 800 wellness centers across 46 states and Guam. It serves employers, unions, and health plans with workplace healthcare. The copied data included:

• Names, addresses, and dates of birth
• Government identification numbers, including Social Security numbers
• Health insurance information
• Diagnostic and treatment information
• Eligibility-related information for Premise Health services

The company obtained preliminary data analysis results on October 14, 2026. It has since validated the data and mailed notification letters to affected individuals. The company confirmed the employee was terminated and law enforcement was notified.

How many people are affected?

The total count remains undisclosed. What is known: more than 66,000 individuals in South Carolina and almost 2,000 in Vermont. That puts the confirmed figure above 68,000, and the national total will likely run higher once other states report. Premise Health said it immediately revoked the employee's credentials, validated security controls, and launched an investigation. The company also said additional security measures are now in place. It did not state why the employee copied the data. It did say it has identified no misuse of the data so far. No misuse identified is not the same as no misuse occurred — the company's own investigation was preliminary as of mid-October.

The disclosure is silent on two points buyers should probe: how a credentialed insider exported bulk patient data without tripping controls for six months, and whether data loss prevention tooling was deployed at all. Premise Health did not address either question.

What happened at Telecare Corporation?

Telecare Corporation, an Alameda, California-based mental and behavioral health services provider, disclosed a separate incident first identified on January 25, 2026. Suspicious activity triggered an investigation. Telecare engaged third-party cybersecurity experts for investigation, containment, and remediation. The company confirmed unauthorized network access and reviewed compromised systems to determine who and what was affected.

The data review finished on September 4, 2026 — 222 days after first detection. That timeline deserves scrutiny; an eight-month review before notification is slow by any standard. The data types varied by individual and may have included names, addresses, Social Security numbers, dates of birth, driver's license numbers, diagnosis and treatment information, lab test results, medications, medical record and patient ID numbers, and health insurance information.

Telecare said it reviewed and revised its technical safeguards. It offered affected individuals complimentary credit monitoring and identity theft protection. The affected-individual count has not been publicly disclosed. The company said it has identified no misuse of the data.

What did Enara Health disclose?

Enara Health, Inc., a digital health platform and virtual care network focused on obesity treatment and weight management, began notifying individuals on November 6, 2026. The incident was first identified on September 10, 2026 — the same day forensics determined an unauthorized third party accessed its provider application.

Enara changed passwords and disabled the affected accounts, then launched an investigation. The company stated its network and other systems remained secure throughout. The application was accessed only for a short time, but data within it was copied. The exposed data types varied by individual and may have included names, email addresses, phone numbers, dates of birth, provider names, and limited self-reported medical information. The affected-individual count is undisclosed.

What should security leaders take from this?

Three healthcare organizations, three incidents, one common pattern: notification without full victim counts. Two of the three — Premise Health and Telecare — involved Social Security numbers and full clinical detail, the combination that drives identity theft risk and regulatory exposure. The insider case at Premise Health is the sharpest lesson, since insider threats bypass perimeter defenses by design and only behavioral monitoring catches them. Every promise of "additional security measures" here comes without named vendors, products, or version specifics, so verification will fall to affected employers and health plans contracting with these providers.