What Happened
Premise Health Holding Corp recently disclosed that a former employee copied patient data without authorization. The details are limited, but the pattern is familiar: someone with legitimate access to protected health information used that access to exfiltrate data they had no business taking with them.
This is the insider threat scenario that perimeter security cannot address. The employee was authenticated. They had authorized access to the files for legitimate job functions. From the network’s perspective, their file access looked normal — because it was normal, right up until the moment they copied those files somewhere they shouldn’t have.
Traditional security controls focus on preventing unauthorized access. They answer the question: should this person be able to see this file? But they struggle with the next question: once someone has legitimate access, what stops them from doing something unauthorized with that data?
Why Traditional Controls Failed
Access control lists and authentication systems are binary: you either have access or you don’t. Once you’re in, you can typically do anything the file system allows — read, copy, email, upload to cloud storage, write to a USB drive.
Network DLP solutions attempt to detect sensitive data leaving the organization by scanning traffic for patterns or signatures. But these systems operate at the wrong layer. An employee who zips and password-protects a file before emailing it, or who copies PHI to a personal USB drive, bypasses network inspection entirely.
Audit logging in Windows Event Log can record file access, but it’s noisy, prone to rollover under PCI DSS audit-everything requirements, and often reviewed only after an incident has already occurred — if it’s reviewed at all.
How FileSure Stops Unauthorized File Copying
FileSure Defend operates at the Windows kernel level via a filter driver. It sits between user-mode applications and the file system, intercepting every file operation: open, read, write, create, delete, rename, move.
For insider threat scenarios like the Premise Health incident, two specific mechanisms apply:
Transmission Security Controls
FileSure policies can restrict which programs are allowed to perform file operations on PHI. An employee can open patient records with the authorized EHR application, but attempts to copy those files to a USB drive, upload via webmail, or sync to Dropbox get blocked at the file system operation layer — before the data leaves the machine.
Example policy configuration:
- File filter:
*.pdf, *.docx, *.xlsxinD:\PatientRecords\ - Allowed programs:
ehr_client.exe,authorized_viewer.exe - Blocked operations: Write to removable drives, write to
%USERPROFILE%\Downloads\, write to cloud sync folders - Result: Legitimate access continues. Unauthorized copying gets blocked and logged.
Tamper-Proof Audit Trail
Every file access is recorded: user name, machine name, program, operation, file path, timestamp. Logs are encrypted, stored separately from the files they track, and cannot be deleted or modified by the user being audited.
When OCR investigates a breach or when internal compliance reviews access patterns, the complete record exists — not buried in Windows Event Log rollover, but in a dedicated, queryable audit database designed specifically for this purpose.
This is the audit control HIPAA’s Security Rule requires: a technical mechanism that records and examines activity in systems containing ePHI.
The Upstream Intervention Point
The strongest defense is the earliest intervention. In this case, that’s the moment the employee attempted to copy PHI to an unauthorized location. The file read operation for legitimate work is allowed. The file write operation to a USB drive or personal email attachment is blocked before it completes.
The data never leaves. The attempt is logged. The compliance team has evidence. The patient data remains protected.
Organizations that wait until data has already been copied — relying on network inspection, endpoint agents, or post-incident forensics — are responding to theft that has already occurred. Kernel-level file operation control prevents the theft from completing in the first place.
Start a free 21-day trial of FileSure Defend at bystorm.com and see how file system operation policies work in your environment — no consultants, no complex deployment, installed and protecting files in under five minutes.
Source: Insider Data Theft Incident Reported by Premise Health
Category: Data Loss Prevention
Tags: insider threat, hipaa, phi exfiltration, healthcare data breach, file system security, kernel filter driver, audit trail
