Premise Health Holding Corp — one of the largest direct healthcare providers in the United States, operating wellness centers for hundreds of employers — has disclosed that a former employee copied patient data without authorization. The disclosure, reported alongside separate data security incidents at Telecare Corporation and Enara Health, lands squarely in the category of breach I see most often mishandled in healthcare IR engagements: the malicious or negligent insider with legitimate access walking out the door with protected health information (PHI).
This is not a vulnerability exploitation story. There is no CVE, no zero-day, no exotic tradecraft. That is precisely what makes it dangerous. The attacker here had valid credentials, authorized endpoint access, and business-justified visibility into patient records. Every perimeter control your organization spent budget on was irrelevant the moment the insider decided to copy data.
For HIPAA-covered entities, the consequences are concrete: breach notification obligations under 45 CFR §§ 164.400–414, potential OCR investigation, civil monetary penalties that scale with culpability (and 'willful neglect' tiers start at six figures per violation category), mandatory notification to affected individuals and — for incidents affecting 500+ individuals — to HHS and prominent media. Beyond the regulatory exposure, insider theft of PHI feeds medical identity fraud, which is far harder for victims to remediate than a stolen credit card number.
If you run security for a healthcare organization, a business associate, or any employer with an on-site/near-site clinic vendor, this incident is your cue to validate that your insider threat program actually works — not that it exists on paper.
Technical Analysis
The Threat Model: Authorized Access, Unauthorized Purpose
Insider data theft in healthcare environments follows a depressingly consistent kill chain that I have reconstructed across dozens of DFIR engagements:
- Access retained through legitimate credentials. The employee has standing access to an EHR (Epic, Cerner/Oracle Health, athenahealth), file shares containing exported reports, or clinical document repositories.
- Collection and staging. The insider queries or exports patient lists, often in bulk — CSV exports from the EHR, mass copies from a network share to a local directory, or ZIP archives staged in a user-writable folder.
- Exfiltration via low-friction channels. In real cases, this is almost always one of: USB mass storage, personal webmail (Gmail/Yahoo) via browser upload, personal cloud storage (Dropbox, Google Drive, OneDrive personal), or — increasingly — simply retaining access after termination because offboarding failed.
- Discovery lag. HIPAA incidents of this type are frequently discovered weeks or months later, often when the former employer notices the data surfacing at a competitor, or during an unrelated audit.
Why Premise Health Matters Specifically
Premise Health operates as a business associate or covered entity depending on arrangement, holding PHI on behalf of employer clients. A single insider copying a patient roster can sweep up thousands of records spanning multiple employer populations — amplifying notification scope and regulatory exposure. The parallel incidents at Telecare Corp and Enara Health reported in the same disclosure cycle underscore that healthcare services organizations remain high-value, comparatively soft targets for both external and internal actors.
Exploitation Status
There is no vulnerability to patch here. The 'exploit' is the gap between access granted for a job function and monitoring of how that access is used. The relevant MITRE ATT&CK techniques are well documented and — critically — detectable with telemetry most organizations already collect:
- T1074 – Data Staged (local aggregation of files before exfiltration)
- T1052 – Exfiltration Over Physical Medium (USB copies)
- T1567.002 – Exfiltration to Cloud Storage (personal webmail/cloud drives)
- T1530 – Data from Cloud Storage Repositories (bulk pulls from SaaS-hosted EHR/HR systems)
- T1078 – Valid Accounts (the access itself is legitimate; behavioral analytics is the detection layer)
The exploitation requirement is trivial: an unhappy, departing, or financially motivated employee and an absence of data-centric controls.
Detection & Response
The detections below target the observable behaviors of insider PHI exfiltration — mass file access, archive staging, USB copies, and browser uploads to personal cloud/webmail destinations. They are written to be tuned against a baseline of your environment; run them in audit mode first against your EHR export paths and file servers before escalating to alerting.
Sigma Rules
---
title: Mass File Access to PHI Directories by Single User
id: 3f9c2a71-8b4d-4e6f-9a1b-2c7d5e8f0a33
status: experimental
description: Detects a single user account accessing an abnormally high volume of files within designated PHI/ePHI directories (EHR exports, clinical shares, patient document repositories) in a short window — consistent with insider collection and staging behavior observed in healthcare data theft incidents.
references:
- https://attack.mitre.org/techniques/T1074/
- https://attack.mitre.org/techniques/T1530/
- https://www.hipaajournal.com/premise-health-telecare-corp-enara-health-data-breaches/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.collection
- attack.t1074
- attack.t1530
logsource:
category: file_event
product: windows
detection:
selection_paths:
TargetFilename|contains:
- '\\EHR-Exports\\'
- '\\PatientRecords\\'
- '\\Clinical\\Documents\\'
- '\\PHI\\'
filter_service_accounts:
User|contains:
- 'svc_'
- 'SYSTEM'
- 'DWM-'
condition: selection_paths and not filter_service_accounts
falsepositives:
- Backup and archival jobs accessing clinical shares
- EHR interface engine service accounts (filter by service account naming convention)
- Health information management (HIM) staff performing legitimate release-of-information batch processing
level: medium
---
title: Archive Creation of Staged Patient Data via Command Line
id: 8e1b4d62-3c5a-4f78-b2e9-6d0a1c4e7f55
status: experimental
description: Detects compression utilities (7-Zip, WinRAR, tar, PowerShell Compress-Archive) invoked against directories commonly used to stage exported patient data — a hallmark of insider exfiltration preparation preceding USB copy or cloud upload.
references:
- https://attack.mitre.org/techniques/T1560/001/
- https://www.hipaajournal.com/premise-health-telecare-corp-enara-health-data-breaches/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_tools:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\tar.exe'
- '\powershell.exe'
- '\pwsh.exe'
selection_cmd:
CommandLine|contains:
- 'Compress-Archive'
- ' a -t'
- '.zip'
- '.7z'
selection_targets:
CommandLine|contains:
- 'patient'
- 'ehr'
- 'phi'
- 'clinical'
- 'export'
condition: selection_tools and selection_cmd and selection_targets
falsepositives:
- IT administrators packaging log exports or interface engine dumps for vendor support
- Automated report distribution scripts (suppress by scheduled task / service account context)
level: high
---
title: Browser Upload to Personal Cloud Storage or Webmail
id: 5c7a9f13-2d6e-4b81-9f3a-8e2d6c1b0a77
status: experimental
description: Detects browser processes establishing connections to personal cloud storage and consumer webmail upload endpoints from endpoints with access to PHI — a common insider exfiltration channel for departing healthcare employees.
references:
- https://attack.mitre.org/techniques/T1567/002/
- https://www.hipaajournal.com/premise-health-telecare-corp-enara-health-data-breaches/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: network_connection
product: windows
detection:
selection_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
selection_destinations:
DestinationHostname|contains:
- 'mail.google.com'
- 'mail.yahoo.com'
- 'outlook.live.com'
- 'dropbox.com'
- 'drive.google.com'
- 'mega.nz'
- 'wetransfer.com'
- 'send-anywhere.com'
- 'anonfiles.com'
condition: selection_browsers and selection_destinations
falsepositives:
- Personal browsing during breaks on corporate endpoints (correlate with file upload volume via proxy logs, not just connection establishment)
- Corporate-sanctioned Google Workspace tenants (scope DestinationHostname to consumer domains only)
level: medium
KQL — Microsoft Sentinel / Defender
The hunt below correlates high-volume file access on PHI-designated shares with subsequent removable-media or cloud egress signals from the same account within a six-hour window — the temporal pattern that separates an insider staging-and-exfil event from routine clinical work. Tune the FileThreshold and the PHI path list to your environment before production use.
// Insider PHI exfiltration hunt: mass access followed by egress signal
let FileThreshold = 200;
let LookbackWindow = 7d;
let CorrelationWindow = 6h;
let PhiPaths = dynamic(["\\\EHR-Exports\\", "\\\PatientRecords\\", "\\\Clinical\\", "\\\PHI\\"]);
let MassAccess =
DeviceFileEvents
| where TimeGenerated > ago(LookbackWindow)
| where FolderPath has_any (PhiPaths)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| summarize FileOps = count(), FirstOp = min(TimeGenerated), LastOp = max(TimeGenerated)
by AccountName, DeviceName, bin(TimeGenerated, 1h)
| where FileOps >= FileThreshold;
let UsbActivity =
DeviceEvents
| where TimeGenerated > ago(LookbackWindow)
| where ActionType == "UsbDriveMount"
| project UsbTime = TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName;
let CloudUploads =
DeviceNetworkEvents
| where TimeGenerated > ago(LookbackWindow)
| where RemoteUrl has_any ("dropbox.com", "drive.google.com", "mail.google.com",
"wetransfer.com", "mega.nz", "mail.yahoo.com")
| project CloudTime = TimeGenerated, DeviceName,
AccountName = InitiatingProcessAccountName, RemoteUrl;
MassAccess
| join kind=inner (UsbActivity) on DeviceName, AccountName
| where UsbTime between (FirstOp .. (LastOp + CorrelationWindow))
| project AccountName, DeviceName, FileOps, FirstOp, LastOp, EgressType = "USB", EgressTime = UsbTime
| union (
MassAccess
| join kind=inner (CloudUploads) on DeviceName, AccountName
| where CloudTime between (FirstOp .. (LastOp + CorrelationWindow))
| project AccountName, DeviceName, FileOps, FirstOp, LastOp, EgressType = RemoteUrl, EgressTime = CloudTime
)
| sort by FileOps desc
For organizations ingesting EHR application audit logs (Epic/Cerner audit trails via Syslog/CEF), add a parallel hunt for anomalous patient record view volumes — a user viewing 10x their peer-group baseline of charts per shift is a leading indicator that precedes endpoint staging entirely.
// Anomalous EHR record-view volume vs peer baseline (requires EHR audit log ingestion via Syslog/CEF)
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has "CHART_ACCESS" or SyslogMessage has "RECORD_VIEW"
| parse SyslogMessage with * "user=" UserId " patient=" PatientId *
| summarize DailyViews = count() by UserId, bin(TimeGenerated, 1d)
| summarize AvgViews = avg(DailyViews), P95 = percentile(DailyViews, 95) by UserId
| where AvgViews > P95 * 3 // user far exceeds even their own heavy days
| project UserId, AvgViews, P95
| sort by AvgViews desc
Velociraptor VQL
Use this artifact for live-response triage on an endpoint belonging to a suspected insider — it enumerates recent USB storage device insertion history alongside recently created archive files in user-writable staging locations. Run it as a hunt across endpoints of users who have given notice or are flagged by HR as flight risks.
-- Insider exfiltration triage: USB history + staged archives + recent mass file writes
-- Deploy as a hunt scoped to departing-user endpoints
LET usb_history = SELECT
KeyName AS DeviceSerial,
Mtime AS LastWriteTime
FROM glob(globs='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*',
accessor='registry')
LET staged_archives = SELECT
FullPath,
Size,
Mtime AS ModifiedTime,
Btime AS CreatedTime
FROM glob(globs=[
'C:\\Users\\*\\**\\*.zip',
'C:\\Users\\*\\**\\*.7z',
'C:\\Users\\*\\**\\*.rar'
])
WHERE ModifiedTime > now() - 86400*14
AND Size > 1000000
SELECT * FROM usb_history
UNION ALL
SELECT * FROM staged_archives
Remediation / Verification Script
This PowerShell script performs three defensive functions on Windows endpoints and file servers: (1) verifies removable storage write access is controlled, (2) audits whether detailed file-share auditing (required for the mass-access detection above) is enabled on PHI directories, and (3) enables USB storage auditing so mount events flow to your SIEM. Run as Administrator; test in a pilot OU first.
# Insider exfiltration hardening & audit verification - run as Administrator
# 1. Verify removable storage deny-write policy (or report gap)
$usbPolicy = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices'
if (Test-Path $usbPolicy) {
Get-ChildItem $usbPolicy -Recurse | ForEach-Object {
$denyWrite = Get-ItemProperty -Path $_.PSPath -Name 'Deny_Write' -ErrorAction SilentlyContinue
Write-Host "[POLICY] $($_.PSChildName): Deny_Write = $($denyWrite.Deny_Write)"
}
} else {
Write-Warning '[GAP] No RemovableStorageDevices policy found. Deploy GPO: Computer Config > Administrative Templates > System > Removable Storage Access > All Removable Storage classes: Deny all access (or scoped by approved-device allowlist).'
}
# 2. Enable file system auditing on designated PHI directories
$phiPaths = @('D:\EHR-Exports', 'D:\PatientRecords', 'D:\Clinical')
foreach ($path in $phiPaths) {
if (Test-Path $path) {
$acl = Get-Acl -Path $path -Audit
$rule = New-Object System.Security.AccessControl.FileSystemAuditRule(
'Everyone','Read,Write,Delete,Modify','ContainerInherit,ObjectInherit','None','Success,Failure')
$existing = $acl.Audit | Where-Object { $_.IdentityReference -eq 'Everyone' }
if (-not $existing) {
$acl.AddAuditRule($rule)
Set-Acl -Path $path -AclObject $acl
Write-Host "[AUDIT] Enabled success/failure auditing on $path"
} else {
Write-Host "[AUDIT] Auditing already present on $path"
}
} else {
Write-Host "[SKIP] $path not present on this host"
}
}
# 3. Confirm advanced audit policy emits the events the Sigma/KQL detections require
auditpol /get /subcategory:"Removable Storage"
auditpol /get /subcategory:"File System"
auditpol /set /subcategory:"Removable Storage" /success:enable /failure:enable
auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable
Write-Host '[DONE] Verify 4663 (file access) and 4663+4656 on shares, plus removable storage events, are flowing to Sentinel/SIEM.'
Remediation
Because this incident class has no patch, remediation is programmatic. Prioritize in this order:
1. Close the offboarding gap — today. In the majority of insider healthcare breaches I have responded to, the exfiltration happened either after notice was given or after termination using access that was never revoked. Enforce same-day (same-hour, for involuntary) deprovisioning: disable AD/Entra ID accounts, revoke EHR sessions and OAuth tokens, kill VPN/ZTNA access, and recover badges and devices. Automate it from the HRIS termination event — a manual ticket queue is a guaranteed delay.
2. Enforce least privilege on PHI repositories. EHR role-based access should map to clinical function, not job title. Audit standing access to export/reporting functions specifically — bulk export capability should require elevated approval and generate an alert by default.
3. Deploy or validate DLP controls on the three real exfil channels. Endpoint DLP (or at minimum GPO-based removable storage restrictions) for USB; web proxy/CASB policies blocking or alerting on uploads to consumer webmail and personal cloud storage from PHI-accessing endpoints; and EHR audit-log analytics for anomalous record-view volumes. The Sigma/KQL content above gives you the detection scaffolding even before commercial DLP lands.
4. Stand up a departing-employee watchlist with HR integration. Employees under notice should trigger heightened monitoring: lower thresholds on file-access analytics, USB mount alerts set to page, and EHR audit review for the notice period. Coordinate with HR and legal first — monitoring must be disclosed and consistent with acceptable use policy.
5. Meet HIPAA obligations deliberately. If you discover an insider incident: preserve forensic evidence immediately (endpoint images, EHR audit trails, proxy logs) before any remediation wipes it; conduct the four-factor breach risk assessment under 45 CFR § 164.402; and calendar the 60-day individual notification deadline and the 500-record HHS/media thresholds. Retain counsel experienced with OCR investigations — how you document the risk assessment determines whether this is a reportable breach or a documented low-probability-of-compromise determination.
6. Test the program. Tabletop the insider scenario annually with HR, legal, compliance, and IT. The organizations that handle these incidents well are the ones where HR knows to call the SOC before the termination meeting, not after.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.