Insider Data Theft Incident Reported by Premise Health – The HIPAA Journal
Insider Data Theft Incident Reported by Premise Health The HIPAA Journal
Insider Data Theft Incident Reported by Premise Health
Premise Health Holding Corp has announced that a former employee copied patient data without authorization. Data security incidents have also been announced by Telecare Corporation and Enara Health.
Premise Health Holding Corp.
Premise Health Holding Corp., a Brentwood, Tennessee-based direct healthcare provider that works with employers, unions, and health plans to provide employer-sponsored and workplace healthcare solutions, has identified unauthorized copying of patient data by a former employee.
Premise Health, which has over 800 wellness centers in 46 states and Guam, said the insider theft incident was identified on September 18, 2026. The employee was determined to have violated company policies and misappropriated company data starting on March 26, 2026. The employee’s credentials were immediately revoked to prevent further access, security controls were validated, and an investigation was launched to determine the extent of data theft.
On October 14, 2026, Premise Health obtained the preliminary results of the data analysis. The data has now been validated, and notification letters have been mailed to the affected individuals. The data copied by the employee included names, addresses, dates of birth, government identification numbers such as Social Security numbers, health insurance information, diagnostic/treatment information, and other information provided in relation to eligibility for Premise Health services.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Premise Health has confirmed that the employee has been terminated and law enforcement has been notified. Premise Health did not state why the employee copied the data but said it has not identified any data misuse. Additional security measures have been implemented to prevent similar incidents in the future. The total number of affected individuals has yet to be publicly disclosed, although the incident is known to have affected more than 66,000 individuals in South Carolina and almost 2,000 individuals in Vermont.
Telecare Corporation
Telecare Corporation, an Alameda, California-based mental health and behavioral services provider, has announced a data security incident that was first identified on January 25, 2026. An investigation was launched after suspicious activity was identified. Third-party cybersecurity experts were engaged to assist with the investigation, containment, and remediation processes. Unauthorized network access was confirmed, and the compromised systems were reviewed to determine the individuals affected and data involved.
The data review was completed on September 4, 2026. Telecare said the types of data involved varied from individual to individual, and may have included names, addresses, Social Security numbers, dates of birth, driver’s license numbers, diagnosis/condition information, treatment information, lab test results, medications, medical record/patient ID numbers, and health insurance information.
Telecare said it has reviewed and revised its technical safeguards and is enhancing data security measures to reduce the risk of similar incidents in the future. No misuse of the affected data has been identified; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services. The number of affected individuals has yet to be publicly disclosed.
Enara Health, Inc.
Enara Health, Inc., a digital health platform provider and virtual care network focused on obesity treatment and weight management, started notifying individuals on November 6, 2026, about a data security incident that was first identified on September 10, 2026.
Suspicious activity was identified within its provider platform. Passwords were changed, the affected accounts were disabled, and an investigation was launched to determine the nature and scope of the activity. The forensic investigation determined that the provider application was accessed by an unauthorized third party on September 10, 2026. Its network and other systems remained secure at all times.
While the application was only accessed for a short time, data within the application was copied. The types of data involved varied from individual to individual and may have included names, email addresses, phone numbers, dates of birth, provider names, and limited self-reported medical information. The number of affected individuals has yet to be publicly disclosed.
The post Insider Data Theft Incident Reported by Premise Health appeared first on The HIPAA Journal.
CISA Seeks More Granular Information on Cyber Incidents – The HIPAA Journal
CISA Seeks More Granular Information on Cyber Incidents The HIPAA Journal
CISA Seeks More Granular Information on Cyber Incidents
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an expanded form for reporting cyber incidents. The updated form, released on November 9, 2026, includes a new questionnaire that requires more granular information on cyber incidents to improve data quality. The additional information will improve CISA’s ability to conduct rapid and thorough threat analyses, more effectively correlate related cyber threat activity to identify larger trends, and prioritize its response actions.
The new form incorporates MITRE ATT&CK Framework language about adversary behavior that is familiar to the cyber community, and requires reporting entities to provide more granular information about the nature of the incident, such as whether the attack involved malware, if social engineering was used, if the incident was due to an insider threat, and the hacking techniques used (if known).
CISA currently only requires cyber incident reporting by federal civilian agencies and certain entities regulated by Transportation Security Administration or the U.S. Coast Guard; however, a final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) is due for release that extends the reporting requirements to critical infrastructure operators. CIRCIA was first proposed in April 2024, and a final rule was pencilled in for release in October 2025; however, it has faced delays. The final rule has been issued by CISA, and it is currently being reviewed by the White House.
When the final rule is issued, the reporting requirements will be extended to certain organizations in 16 critical infrastructure sectors, which will be required to report substantial cyber incidents to CISA within 72 hours, and any ransom payments within 24 hours. No timeline has been released on when the final rule will be issued. Mandatory reporting aside, CISA requests that all organizations voluntarily use the form to submit information about cyber incidents they experience, as the information will help the agency identify attack trends and take prompt action in response to emerging threats.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
“In the team sport of cybersecurity, one organization’s detection is another’s protection,” said Acting Executive Assistant Director for Cybersecurity Chris Butera. “As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense.”
The post CISA Seeks More Granular Information on Cyber Incidents appeared first on The HIPAA Journal.
OSHA Medical Courier Training Online
OSHA medical courier training online is available from The HIPAA Journal as three self-paced courses, each with its own certificate: the OSHA BBP Certification for Medical Couriers covering blood-borne infection, the OSHA HazCom Certification for Medical Couriers on chemical hazards, and the OSHA PPE Certification for Medical Couriers on protective gear. The three are also sold together, with an added introductory lesson on OSHA itself, as the OSHA Certification for Medical Couriers. Every course runs in any web browser, whether on a phone, tablet, laptop, or desktop. Each lesson closes with a quiz, and passing every one unlocks the certificate.
Which OSHA Standards Govern Courier Deliveries?
Three OSHA standards govern courier deliveries: 29 CFR 1910.1030 on bloodborne pathogens, 29 CFR 1910.1200 on hazard communication, and 29 CFR 1910.132 on personal protective equipment. Specimen bags carry blood and body fluids. Pickups from laboratories and pharmacies include reagents, disinfectants, and preservatives. Gloves and other protective items stand between the driver and both hazards.
Each standard sets its own instruction requirement for employers. A courier firm meets them by training drivers before their first exposure and keeping proof that the training happened.
Can Couriers Complete OSHA Training Online?
Couriers can complete OSHA training online, and OSHA accepts computer-based instruction provided the employer supplements it where a standard calls for more. The bloodborne pathogens standard gives trainees the right to question a knowledgeable person, so the employer names a supervisor, safety lead, or trainer who answers them. The PPE standard requires workers to show they understand the material, and a short hands-on check of glove removal satisfies that step.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The online course carries the general content. The employer adds the details of its own exposure control plan, its chemical inventory, and the specific gear it issues.
What Does the OSHA BBP Certification for Medical Couriers Teach?
The OSHA BBP Certification for Medical Couriers teaches how infections carried in blood reach a worker and how a courier prevents and responds to exposure, across 12 lessons. Opening lessons describe the pathogens themselves and the safety principles behind Universal Precautions. Middle lessons work through engineering controls, safe work practices, and the place of protective equipment within the hierarchy of controls.
Later lessons explain the Hepatitis B vaccine, the handling of regulated waste, and how to recognize hazards during deliveries. The course then covers what counts as an exposure incident, the paperwork that follows one, and the purpose of an employer’s exposure control plan. A lesson on how bloodborne pathogen rules vary between jurisdictions comes before the closing summary.
A driver who finds a cracked tube leaking inside a transport bag learns from this course which surfaces to treat as contaminated, how to clean them, and whom to notify. The course costs $26.25 during a time-limited offer, against a standard $35.00.
What Does the OSHA HazCom Certification for Medical Couriers Teach?
The OSHA HazCom Certification for Medical Couriers teaches couriers to identify hazardous chemicals, read the information that accompanies them, and act safely when a container leaks, in three lessons. The first lesson sets out how OSHA classifies a chemical as hazardous, where such products turn up in healthcare and delivery settings, and the worker’s right to know about them.
Lesson two explains the Globally Harmonized System, the elements printed on a label, the labeling of secondary containers, and the 16 sections of a Safety Data Sheet. The third covers exposure routes, safe storage and handling, spill response, disposal, symptoms of exposure, first aid, and incident reporting.
Couriers moving formalin containers, cleaning agents, or laboratory reagents use this training to decide whether a package can travel in the cab and what to do if one breaks. Enrollment costs $26.25 during the current promotion, reduced from $35.00.
What Does the OSHA PPE Certification for Medical Couriers Teach?
The OSHA PPE Certification for Medical Couriers teaches couriers when protective equipment is needed, which type fits a task, and how to put it on and take it off without spreading contamination, in four lessons. The course opens by placing protective equipment as the final layer in the hierarchy of safety controls, after foreseeable hazards have been addressed by other means.
Subsequent lessons explain how equipment fails and how correct use limits cross-contamination. They survey protection for the head, eyes and face, lungs, hands, body, feet, and hearing, along with task-specific items. The last lesson covers donning and doffing, checking fit and seal, storage, disposal, when to replace items, and managing heat stress and fatigue.
Glove removal is the step where contamination reaches skin, and the course trains drivers to peel gloves inside out and dispose of them before touching a steering wheel or phone. The price is $26.25 under a time-limited discount, against a regular $35.00.
What Does the OSHA Certification for Medical Couriers Combine?
The OSHA Certification for Medical Couriers joins the blood, chemical, and protective gear courses in one enrollment and adds an introductory lesson on OSHA. That opening lesson describes the agency, its enforcement of standards, the rights couriers hold, the way to raise a safety concern, and the link between state plans and federal rules.
The bundle costs $78.75 during the promotion, down from $105.00. Couriers receive one OSHA certificate after finishing every module and passing each quiz, and a single login covers the full curriculum for a year.
Should Couriers Buy Individual Courses or the Bundle?
Couriers should buy individual courses when one credential is missing or due for renewal, and the bundle when starting with no OSHA training on file. A driver whose hazard communication certificate has lapsed, while the other two remain current, buys the HazCom course alone for $26.25. A new driver gains the introductory OSHA lesson and one consolidated certificate by choosing the bundle.
Drivers needing HIPAA certification as well weigh both options against the HIPAA and OSHA Certification for Medical Couriers. That option adds the HIPAA course for $79.95 during the promotion.
How Do the Online Lessons Work?
The online lessons open straight after purchase and run in short segments that a courier can pause and resume at any point. Courier schedules leave no fixed hour for training, so drivers complete lessons around their shifts, on whichever device is at hand. Subtitles and a speed control support study in waiting areas and other noisy places.
Each course remains available for 12 months after purchase. A courier unsure how to handle a leaking reagent bottle in July reopens the HazCom lesson on spill response that same day.
How Is Learning Assessed Before a Certificate Is Issued?
Learning is assessed through a short quiz after every lesson, and the certificate appears only after every quiz in the course is passed. Learners retake any quiz without charge until they reach the pass mark. The courses have no closing exam.
Assessment-backed certification gives employers stronger evidence than a completion record built on viewing time. A certificate from these courses shows that the courier answered questions on the material correctly, rather than only that the lessons were opened.
How Do Clients Check a Courier’s OSHA Certificates?
Clients check a courier’s OSHA certificates using the free verification tool maintained by The HIPAA Journal. Certificates download or print as soon as a course is finished. Couriers attach them to vendor applications, and the laboratory, hospital, or pharmacy confirms them online at no cost.
When Do Couriers Repeat OSHA Training?
Couriers repeat bloodborne pathogens training no more than a year apart, the interval 29 CFR 1910.1030 fixes for blood-exposed workers. Hazard communication training is repeated whenever a new chemical hazard enters the work. Protective equipment training is repeated after the tasks or the issued gear change, or once a worker’s handling of the equipment shows the earlier instruction did not take hold.
Couriers who renew all three courses together each year keep a single renewal date. Client contracts can set that annual cycle for every OSHA credential in a vendor file.
What Sets The HIPAA Journal’s OSHA Courier Courses Apart?
The HIPAA Journal’s OSHA courier courses sit next to its HIPAA courses, so a courier firm sources workplace safety and patient privacy instruction from one healthcare-focused provider. Purchasing, records, and certificate checks then run through a single account and a single verification service. Drivers study material written around specimen pickups, pharmacy deliveries, and laboratory drop-offs rather than factory or construction settings.
Pricing is all-inclusive, with certificates, quiz retakes, and verification covered by the course fee.
The post OSHA Medical Courier Training Online appeared first on The HIPAA Journal.
Cybercriminals Hit Two California Dental Practices – The HIPAA Journal
Cybercriminals Hit Two California Dental Practices The HIPAA Journal
Cybercriminals Hit Two California Dental Practices
Data security incidents have recently been announced by Santa Barbara Endodontics & Hollister Family Dental & Implant Center in California, and Park Dental Partners in Minnesota.
Santa Barbara Endodontics
Santa Barbara Endodontics, an endodontics-focused dental practice in California, has notified patients that it recently fell victim to a ransomware attack in which patient records were likely stolen. According to its November 7, 2026, data breach notice, the intrusion was identified on October 8, 2026, when the practice received a ransom note. The practice confirmed that patient records had been encrypted, and an investigation into the attack is ongoing. At present, the practice has not determined the extent to which patient data was involved, nor when the ransomware group first accessed its network.
The practice has confirmed that it was able to restore the affected records from backups without paying the ransom and has warned patients that their protected health information may have been stolen. The impacted data includes names, Social Security Numbers (if provided to the practice), medical/dental histories, mental/physical condition information, endodontic treatment or diagnosis information, insurance information, and information relating to past claims for payments for its services.
The practice has engaged an external cybersecurity firm to assist with the investigation, has notified law enforcement, and is reviewing its security policies, procedures, and practices. The practice confirmed that it is aware of the threat actor’s (The Gentlemen) threats to publish the stolen data and that its cybersecurity partner is monitoring for any release of patient data. The affected individuals have been offered 12 months of complimentary credit monitoring and identity theft protection services and have been advised to monitor their accounts and explanation of benefits statements for signs of data misuse.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Hollister Family Dental & Implant Center
Hollister Family Dental & Implant Center in California has started notifying patients about a recent cybersecurity incident involving its third-party appointment management system. The practice was alerted about an issue with the platform on May 8, 2026, and immediate action was taken to secure the system. The forensic investigation confirmed that the platform was accessed by an unauthorized third party intermittently between February 12, 2026, and May 8, 2026.
During that time, patient data may have been viewed or acquired, including names, contact information, dates of birth, and information related to dental care, including appointment information, questions, providers, symptoms, and medications. No misuse of the exposed information has been identified; however, as a precaution, the affected individuals have been offered complimentary credit monitoring and identity theft protection services for 2 years. The number of affected individuals has not yet been publicly disclosed.
Park Dental Partners
Park Dental Partners, Inc., a Roseville, Minnesota-based dental resource organization that provides business support services and equipment to dental practices in Minnesota, Wisconsin, Arizona, and North Carolina, has started notifying individuals affected by an August cybersecurity incident. According to its notification letters, an unauthorized third party accessed its network between August 26, 2026, and August 27, 2026.
The review of the exposed data was completed on October 7, 2026, when it was confirmed that full names, dates of birth, diagnoses, treatment information, and health insurance policy information were potentially viewed or obtained. The number of affected individuals has yet to be publicly disclosed.
The post Cybercriminals Hit Two California Dental Practices appeared first on The HIPAA Journal.
Sutherland Healthcare Solutions; Hoag Memorial Hospital Presbyterian Announce Cyber Incidents
Data breaches have recently been confirmed by HIPAA business associate Sutherland Healthcare Solutions and the California hospital system, Hoag Memorial Hospital Presbyterian.
Sutherland Healthcare Solutions
Sutherland Healthcare Solutions, a provider of revenue cycle management, provider management and credentialing, medical coding, and digital transformation services to healthcare payers, providers, and MedTech companies, has identified a data privacy incident that occurred over a two-year period between 2024 and 2026.
According to its notification letters, unbeknownst to the company, an employee engaged another individual to conduct work duties on their behalf. At various times between July 29, 2024, and July 10, 2026, the unauthorized individual accessed information such as names, addresses, dates of birth, health plan information, Social Security numbers, health insurance claims data, and plan members’ stated gender. When the unauthorized access was identified, the employee’s access rights were swiftly terminated. The affected health plans were notified to determine the individuals and data involved, and notification letters have recently been mailed to the affected individuals.
The unauthorized access does not appear to have been malicious in nature. Sutherland Healthcare Solutions has not identified any data misuse as a result of the incident; however, as a precaution, the affected individuals have been offered complimentary identity theft protection services and additional technical and administrative measures have been implemented to reduce the risk of similar incidents in the future. The incident is not yet shown on the HHS Office for Civil Rights breach portal, and the number of affected individuals has yet to be publicly disclosed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Hoag Memorial Hospital Presbyterian
Hoag Memorial Hospital Presbyterian, a nonprofit hospital network serving patients in Orange County, California, has identified unauthorized access to its computer network and the potential theft of patient information. Suspicious network activity was first identified by Hoag on October 8, 2026. External cybersecurity and digital forensics experts were engaged to investigate the activity and confirmed unauthorized access.
The exposed files were reviewed, and on October 25, 2026, Hoag confirmed that personal and protected health information had been exposed. The types of information involved are not detailed in the publicly available breach notification letters; however, they are listed in the individual notification letters mailed to the affected individuals in early November. Complimentary credit monitoring and identity theft protection services have been made available, and security measures have been enhanced to prevent similar incidents in the future. The number of affected individuals has yet to be publicly disclosed.
The post Sutherland Healthcare Solutions; Hoag Memorial Hospital Presbyterian Announce Cyber Incidents appeared first on The HIPAA Journal.
11 HIPAA Compliance Software: The 2026 Buyer’s Verdict Guide – GBHackers News
11 HIPAA Compliance Software: The 2026 Buyer’s Verdict Guide GBHackers News