HHS OCR settlement announced September 17, 2026
One Phishing Email, Then a $700,000 HIPAA Settlement: Ambry Genetics and the Missing Risk Analysis
Ambry Genetics, a California genetic testing and clinical genomics company, agreed to pay $700,000 and operate under a two-year corrective action plan to resolve HHS Office for Civil Rights findings from a January 2020 phishing incident in which an employee's email account was accessed between January 22 and 24, 2020, potentially exposing the electronic protected health information of 225,370 individuals, including names, addresses, dates of birth, driver's license numbers, diagnoses, medications, treatment information, and some Social Security numbers. OCR's investigation did not rest on the phishing click itself. It found three Security Rule failures: no accurate and thorough risk analysis of risks to ePHI, no procedures for terminating access when employment or the need for access ended, and no unique user identification for all workforce members accessing ePHI. The corrective action plan requires exactly those items, plus a risk management program, revised policies, and workforce training, with OCR monitoring for two years. HIPAA Journal reports this was OCR's 10th financial penalty of the year and 188th to date, that all but one of this year's penalties resolved risk analysis failures, and that Ambry separately settled class action litigation over the breach for $12.25 million.
Executives
The breach was in 2020, the phishing email was ordinary, and the settlement still landed in 2026, because the findings were about preparation, not the attack. OCR's pattern this year is consistent enough to price in: if your organization cannot produce a current, thorough risk analysis, a single compromised mailbox can become a multi-year regulatory and litigation bill, and here the private litigation cost more than ten times the federal penalty.
CIO / CISO
Close the three cited gaps as a set, because OCR treats them as one program: a dated risk analysis covering every system that holds ePHI, including email, a written risk management plan with owners and deadlines that follows from it, tested offboarding that terminates access on the last day with evidence retained, and unique user IDs with audit logs that attribute activity to a person. Shared logins in clinical add-ons and portals are the quiet version of the third finding.
Engineers
Make the evidence automatic: mailbox audit logging and retention that would show exactly what a compromised account touched, deprovisioning hooks tied to HR status changes across every ePHI system, and an inventory of where ePHI accumulates, including mailboxes, spool folders, and exports. When the regulator asks what one account could reach, your tooling should answer in hours.
Everyone (non-IT)
A genetics company's patients had diagnoses, medications, and in some cases Social Security numbers exposed because one employee's email was compromised. Your own protection is unchanged and practical: use unique passwords and multifactor authentication on health portals, and take breach notifications seriously when they offer credit monitoring.