Premise Health Data Breach: Employee Misappropriated Data, Not a Hack

In letters dated November 6, 2026, Premise Health Holding Corp. says it discovered on September 18, 2026, that an employee had violated its information security policies and misappropriated company data beginning on or about March 26, 2026. Its website notice adds that this was not a hacking or ransomware event and that its health centers stayed open.

Premise says it revoked the employee’s credentials and system access, checked its security controls, and investigated. It received a preliminary analysis of the data on October 14, 2026, fired the employee, and reported the incident to law enforcement.

The letter says the information varied by person and may have included names, addresses, dates of birth, government ID numbers such as Social Security numbers, health insurance information, diagnostic or other treatment information, and other details provided in connection with eligibility for Premise services.

State records match that description. Texas lists Social Security, medical, and health insurance information; Massachusetts marks Social Security numbers and medical records; and Washington and Vermont include Social Security numbers along with medical or health records. Premise says it isn’t aware of any misuse of the information.

Premise Health partners with commercial and municipal employers, health plans, unions, and tribes, and says it serves millions of members at more than 800 wellness centers in 46 states and Guam. It says it is notifying affected people directly where it has enough contact information to reach them.

Premise hasn’t published a total. Five state filings count 261,654 Texans, 60,641 South Carolinians, 49,444 Washingtonians, 43,046 Massachusetts residents, and 1,948 Vermonters, or 416,733 combined, and because Premise filed in California, more than 500 Californians are generally understood to be involved. As of November 11, 2026, the incident isn’t on the federal HHS breach list, whose newest entries are from October 15.

Premise is offering free Experian IdentityWorks membership with credit monitoring, identity restoration support, and $1 million in identity theft insurance. The public sample leaves the number of months blank, so check your letter, and enrollment closes February 26, 2027. Letters sent for a minor child come with a separate enrollment option.

The company says it continues to monitor its systems and has added security measures. Premise discovered the employee’s conduct nearly six months after it began, and its letters followed about seven weeks after that.

Since Social Security numbers, insurance details, and treatment information are on the list, these steps cover both identity theft and medical fraud:

• Enroll in Experian IdentityWorks by February 26, 2027. Use the adult or minor activation code printed in your letter.
• Look over explanations of benefits from your health plan. Check for treatments, visits, or prescriptions you never had.
• Freeze your credit with Equifax, Experian, and TransUnion. Freezes cost nothing to place or lift and block new accounts in your name until you lift them.
• Pull your credit reports and read them line by line. Accounts or inquiries you don’t recognize are a reason to act quickly.
• Stay alert for messages that mention Premise or your workplace health center. Verify any outreach independently before responding.

Use these as general pointers rather than legal advice. A legal professional can tell you which ones matter for your situation and what rights you may have.

Did a Premise Health letter say your Social Security number or treatment information was in the data an employee misappropriated? Wilshire Law Firm is headquartered in California and handles data breach and consumer protection class actions nationwide. Insider breaches involving hundreds of thousands of health records are sometimes pursued as class actions. Speak with a legal professional from our nationally recognized, award-winning team in a free consultation or free case review, available 24/7; there are no fees unless you get paid.

Contact Wilshire Law Firm to discuss your Premise Health letter.