Premise Health Data Breach

An employee at Premise Health took patient information starting around March 2026, and the company did not discover it until September. Social Security numbers, insurance details and treatment information were involved.

What Happened at Premise Health

Premise Health Holding Corp. is based in Brentwood, Tennessee. It runs health centers that many employers offer to their workers and families.

On November 6, 2026, Premise Health reported a data breach to the California and Vermont Attorneys General. According to those filings, an employee misappropriated data starting around March 26, 2026. To misappropriate data means to take or use it without permission.

Premise Health discovered the issue on September 18, 2026.

An Inside Job That Went Unnoticed for Months

This breach did not start with an outside hacker. According to the filings, it came from someone inside the company.

The activity began around March 26, 2026. Premise Health discovered it on September 18, 2026. That is nearly six months. Notices were filed about seven weeks after discovery.

Premise Health has not publicly explained how the activity went undetected for that long, based on the filings reviewed.

How Many People Were Affected?

The Vermont filing lists 1,948 Vermont residents. The California filing indicates more than 500 California residents, since California posts notices only above that number. Together, that is at least 2,448 people.

Premise Health has not disclosed a national total in the sources reviewed. Because it serves employer health centers across the country, the real number could be higher.

What Information Was Exposed?

Based on the state filings, the information involved includes:

• Social Security numbers or government ID numbers
• Health insurance information
• Diagnosis and treatment information

What Is Premise Health Offering Affected Patients?

In the sources reviewed, Premise Health has not publicly disclosed whether it is offering credit monitoring or identity protection. Anyone who received a letter should check it for enrollment details and deadlines.

Your Information Is at Risk

This breach mixes identity data with medical data. A Social Security number can be used for financial fraud. Insurance and treatment details can be used for medical identity theft, such as getting care or filing claims in someone else’s name. Medical information can also be deeply personal.

Affected individuals should:

• Review Explanation of Benefits statements from your health plan
• Place a free credit freeze with Equifax, Experian and TransUnion
• Request your medical records if you see services you did not receive
• Keep a copy of any notice letter you receive
• Talk with a data breach attorney about your options

Do You Have Legal Options?

Healthcare organizations have a legal obligation to safeguard patient information, including controlling what employees can access. When that obligation is not met, affected individuals may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

How many people were affected by the Premise Health data breach?

Premise Health has not shared a total. State filings show 1,948 Vermont residents and more than 500 California residents, so at least 2,448 people.

What information was exposed?

• Social Security numbers or government ID numbers
• Health insurance information
• Diagnosis and treatment information

Who took the data?

According to the filings, an employee misappropriated the data. Premise Health has not publicly named the person.

What can someone do with my medical information?

Medical data can be used to:

• Get care or prescriptions in your name
• Bill your insurance for services you never received
• Add false information to your medical records

Check every Explanation of Benefits you receive.

What should I do if I received a notification letter?

• Review your health plan statements
• Place a free credit freeze
• Keep your letter
• Call a data breach attorney

Could scammers use this breach to contact me?

Yes, that is a common risk after a breach. Criminals sometimes send emails, texts or calls that mention the incident by name to seem real. Be careful with any message that:

• Asks you to confirm your Social Security number or account details
• Pushes you to act fast or pay a fee
• Includes a link or attachment you did not expect

When in doubt, contact the company using a phone number or website you already trust.

Do I have a legal claim?

You may. Organizations that collect Social Security numbers and other sensitive information have a duty to protect it and to tell people promptly when it is exposed. If Premise Health did not meet those duties, you may have legal rights and remedies. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.