Premise Health Insider Breach Could Affect Millions

An insider data breach at Premise Health Holding, an employer- healthcare organization, has affected nearly 417,000 people in five states, with the nationwide toll potentially reaching into the millions. The full extent of the incident remains undisclosed, but the Tennessee-based company, which provides services to 11 million members in 46 states, has reported the incident to law enforcement.

See Also: Your Face Is Your Boarding Pass: How Biometric Identity Is Redefining the Way We Travel

As of Thursday, the attorneys general of five states had posted breach reports filed by Premise Health since last week. The company reported that 261,654 Texas residents were affected, along with 60,641 in South Carolina, 49,444 in Washington state, 43,046 in Massachusetts and 1,948 in Vermont.

Premise Health also filed a report with California's attorney general, but the state doesn't publicly disclose the number of people affected by reported breaches.

In a breach notice posted on its website, Premise Health said that on Sept. 18 it discovered an employee had "violated company information security policies and misappropriated certain company data" beginning on or March 26.

"This was not a hacking or ransomware event. There has been no interruption to our operations and our sites remain fully available to serve patients," Premise Health said.

Upon discovering the incident, Premise Health said it revoked the employee's credentials and system access, validated its security controls and launched an investigation.

The company received a preliminary analysis of the relevant data on Oct. 14. Further analysis confirmed that patients' personal information had been affected.

The compromised information varied by individual but potentially included names, addresses, dates of birth, government identification numbers such as Social Security numbers, health insurance information, diagnostic and treatment information, and other data provided in connection with their eligibility for services or their relationship with Premise Health.

"The employee has been terminated. We have also reported the incident to law enforcement. We continue to monitor our systems and have introduced additional measures to further enhance our security defenses," the company said.

Premise Health did not immediately respond to ISMG's request for additional details, including the employee's job role, how the suspicious activity was detected, the total number of people affected nationwide and the status of the law enforcement investigation.

The Premise Health incident is the latest in a series of significant healthcare insider breaches, some involving prolonged unauthorized access to patient records and others resulting in litigation, criminal investigations and regulatory enforcement.

In October 2025, Texas-based Harris Health notified 5,000 patients of a breach involving a former employee who improperly accessed electronic health records for more than a decade. The healthcare organization said it discovered the incident in 2021 and reported it to the FBI, but did not begin notifying affected individuals until four years later, after receiving clearance from the bureau (see: Hospital Insider Breach Lasted 10 Years, Led to FBI Inquiry ).

In March, a federal court approved a $5 million settlement in consolidated class action litigation against Pennsylvania-based Geisinger Health and Nuance Communications, part of Microsoft, stemming from a 2023 insider breach affecting more than 1 million Geisinger patients (see: $5M Settlement in Geisinger Health, Nuance Insider Breach ).

In that case, a former Nuance employee faced federal criminal charges two days after being terminated from his job in 2023. Authorities say he downloaded and stored more than 1 million Geisinger patient records on a personal external hard drive (see: Ex-Nuance Worker Faces More Charges in Geisinger Breach ).

Federal regulators also have taken enforcement actions against several HIPAA-regulated organizations involving insider breaches.

Among them was a $1.9 million civil monetary penalty imposed in 2024 by the U.S. Department of Health and Human Services against Gulf Coast Pain Consultants, which does business as Clearway Pain Solutions Institute, following an investigation into a 2019 insider breach affecting nearly 35,000 people (see: Insider Breach, Email Attacks Net $1.7M in HIPAA Fines ).

In that case, HHS' Office for Civil Rights said Gulf Coast had retained a contractor in May 2018 to provide business consulting services. The contractor stopped providing those services in August 2018.

But in February 2019, Gulf Coast discovered that the former contractor had continued accessing the practice's electronic medical records without authorization on three occasions to retrieve patients' protected health information for use in potential fraudulent Medicare claims. Gulf Coast terminated the contractor's system access after discovering the activity.

Such cases underscore the challenges healthcare organizations face in detecting inappropriate activity by workers who have, or previously had, legitimate access to sensitive information.

One reason malicious insider activity often goes undetected for extended periods is insufficient review of employee activity, said Tom Walsh, founder and managing partner of healthcare privacy and security consulting firm tw-Security.

"Organizations often struggle to monitor authorized users while defending against external attackers," he said. "We recommend behavioral analytics and patient privacy monitoring tools to flag potentially inappropriate access to protected health information and personally identifiable information," he said.

Walsh said his firm routinely finds that organizations lack a written audit strategy and instead conduct reviews on an ad hoc basis. "A documented strategy and automated monitoring help identify suspicious activity that could otherwise be lost among millions of legitimate transactions," he said.

Another challenge is detecting insiders who steal data gradually rather than through a single large transfer. Security alerts often focus on large data movements and may miss repeated extraction of smaller amounts of information, Walsh said.

"A risk analysis should assess who can export large numbers of patient records and how those exports are monitored. Bulk-export privileges should be limited to employees with a demonstrated business need," Walsh said.

The growing use of artificial intelligence in healthcare adds another dimension to insider threats. While AI tools can help organizations detect unusual behavior sooner, they also can help malicious insiders locate sensitive information and automate its collection, Walsh said.

"The outcome depends on access restrictions, monitoring and how quickly organizations respond to warning signs."

Even ordinary business AI tools could be misused for malicious purposes, Walsh said. For example, AI assistants can help insiders locate confidential information across repositories they are authorized to access, while AI-enabled optical character recognition and document extraction tools can convert scans, images and PDFs into searchable, structured data.

AI coding assistants also could enable employees with limited programming skills to automate repetitive data collection or extraction. AI image and document editing tools could be used to create or alter materials supporting identity theft or fraud, Walsh said. The FBI also has warned AI-enabled fraud schemes.

But AI also offers healthcare defenders tools to detect suspicious insider activity earlier, Walsh said. He identified three particularly useful categories: user and entity behavior analytics, patient privacy monitoring and data loss prevention.

User and entity behavior analytics tools can detect and alert organizations in real time to potentially inappropriate access to PHI and PII. Patient privacy monitoring tools can analyze EHR access using clinical context, employee roles, patient dates of service, time of day and behavioral patterns to identify possible snooping or other unauthorized activity.

Meanwhile, data loss prevention tools can help detect suspicious movement or exfiltration of sensitive information, Walsh said. But effective use of DLP "requires labeling or classifying data appropriately," he said.