A former Premise Health employee copied patient files, including Social Security numbers. Letters are going out, and two other health firms reported breaches.
A former employee of Premise Health, a company that runs workplace health clinics, copied patient records without permission. The data included Social Security numbers and diagnosis details. The company has mailed notice letters to those affected. If one arrives, it is worth opening.
Premise Health is based in Brentwood, Tennessee. It works with employers, unions and health plans, and has over 800 wellness centers in 46 states and Guam. The company says the employee broke its rules and began taking company data on March 26, 2026. The theft was found on September 18, 2026, and the employee's access was cut off right away.
On October 14, the company got early results from its review of the data. It has since confirmed the findings and sent letters. The employee has been fired, and law enforcement has been told. The company did not say why the data was copied, and it says it has found no sign the data was misused.
The copied files included:
The total number of people affected has not been made public. Reports so far show more than 66,000 people in South Carolina and almost 2,000 in Vermont. If you have never used a Premise Health clinic, this incident likely does not involve you.
Two other health companies also reported problems. Telecare, a mental health provider in Alameda, California, found unauthorized access to its network on January 25, 2026. Its review ended September 4. Depending on the person, the data may have included Social Security numbers, driver's license numbers, medications and lab results. Telecare is offering free credit monitoring and says it found no misuse.
Enara Health, which runs weight management care online, began sending notices on November 6. An unauthorized person got into its provider application on September 10 and copied data. That data may have included names, emails, phone numbers, birth dates and limited medical details the patient reported. Social Security numbers are not on the company's list. Neither company has said how many people were affected.
Medical records mix health details with identity details. A Social Security number can be used to open accounts or file false claims in your name. Health information is also personal in a way a password never is. Fraud can show up months later, so a lack of misuse today is not a guarantee.
The steps in the alert box above cover what to do if you get a letter. Watch for scam calls and emails that claim to be about this incident. A real notice comes by mail, and no one needs your details over the phone to confirm it.
Premise Health has not said why the data was copied or how many people in total are affected. Telecare and Enara Health have not given counts either. More numbers may come as states receive filings.
If a notice letter from Premise Health, Telecare or Enara Health arrives, read it fully and watch your accounts and statements for activity you do not recognize.
CISA's new incident form asks for more detail on hacks, and a coming rule could force some firms in 16 key sectors to report attacks within 72 hours.
Read more: US cyber agency asks for more detail when companies report hacksA flaw hidden in OpenSSH for about a decade lets attackers into some locked Linux accounts with an oversized password. Check whether your servers are affected.
Read more: Decade-old flaw lets attackers in with an oversized passwordUS officials say attackers are using a flaw in Cisco BroadWorks, software behind many business phone services, and a patch has been out since August.
Read more: Hackers are exploiting a flaw in Cisco's business phone software
