Premise Health Holding Corp has announced that a former employee copied patient data without authorization. Data security incidents have also been announced by Telecare Corporation and Enara Health. Premise Health Holding Corp.
Premise Health Holding Corp. , a Brentwood, Tennessee-based direct healthcare provider that works with employers, unions, and health plans to provide employer-sponsored and workplace healthcare solutions, has identified unauthorized copying of patient data by a former employee. Premise Health, which has over 800 wellness centers in 46 states and Guam, said the insider theft incident was identified on September 18, 2026.
The employee was determined to have violated company policies and misappropriated company data starting on March 26, 2026. The employee’s credentials were immediately revoked to prevent further access, security controls were validated, and an investigation was launched to determine the extent of data theft. On October 14, 2026, Premise Health obtained the preliminary results of the data analysis.
The data has now been validated, and notification letters have been mailed to the affected individuals. The data copied by the employee included names, addresses, dates of birth, government identification numbers such as Social Security numbers, health insurance information, diagnostic/treatment information, and other information provided in relation to eligibility for Premise Health services.
Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form. Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy Premise Health has confirmed that the employee has been terminated and law enforcement has been notified.
Premise Health did not state why the employee copied the data but said it has not identified any data misuse. Additional security measures have been implemented to prevent similar incidents in the future. The total number of affected individuals has yet to be publicly disclosed, although the incident is known to have affected more than 66,000 individuals in South Carolina and almost 2,000 individuals in Vermont.
Telecare Corporation Telecare Corporation, an Alameda, California-based mental health and behavioral services provider, has announced a data security incident that was first identified on January 25, 2026. An investigation was launched after suspicious activity was identified. Third-party cybersecurity experts were engaged to assist with the investigation, containment, and remediation processes.
Unauthorized network access was confirmed, and the compromised systems were reviewed to determine the individuals affected and data involved. The data review was completed on September 4, 2026. Telecare said the types of data involved varied from individual to individual, and may have included names, addresses, Social Security numbers, dates of birth, driver’s license numbers, diagnosis/condition information, treatment information, lab test results, medications, medical record/patient ID numbers, and health insurance information.
Telecare said it has reviewed and revised its technical safeguards and is enhancing data security measures to reduce the risk of similar incidents in the future. No misuse of the affected data has been identified; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The number of affected individuals has yet to be publicly disclosed.
Enara Health, Inc. Enara Health, Inc. , a digital health platform provider and virtual care network focused on obesity treatment and weight management, started notifying individuals on November 6, 2026, about a data security incident that was first identified on September 10, 2026.
Suspicious activity was identified within its provider platform. Passwords were changed, the affected accounts were disabled, and an investigation was launched to determine the nature and scope of the activity. The forensic investigation determined that the provider application was accessed by an unauthorized third party on September 10, 2026.
Its network and other systems remained secure at all times. While the application was only accessed for a short time, data within the application was copied. The types of data involved varied from individual to individual and may have included names, email addresses, phone numbers, dates of birth, provider names, and limited self-reported medical information.
The number of affected individuals has yet to be publicly disclosed. The post Insider Data Theft Incident Reported by Premise Health appeared first on The HIPAA Journal .
Originally published at hipaajournal.com
