Lessons from Ambry Genetics' $700K HIPAA Settlement

A phishing attack compromised one employee’s email account. That’s how this story starts. But the $700,000 figure at the end of it has almost nothing to do with the phishing attack itself — it has to do with what happened, or didn’t happen, before anyone clicked.

What Actually Happened

On September 17, the HHS Office for Civil Rights announced a $700,000 settlement with Ambry Genetics Corporation, a California-based genetic testing and clinical genomics company, along with a two-year corrective action plan. The underlying incident dates back to January 2020: a phishing attack compromised an employee’s email account, and Ambry reported the breach to OCR in March 2020, disclosing that it potentially affected up to 225,370 individuals.

Worth noting upfront: a settlement like this resolves potential violations by agreement. It isn’t an adjudicated finding of fault, and Ambry didn’t admit liability as part of it. What matters for other healthcare organizations isn’t the verdict — it’s what OCR’s investigation actually looked at.

The Part That Should Get Your Attention

OCR’s investigation didn’t center on whether the phishing email should have been caught. It centered on what Ambry had — and hadn’t — put in place beforehand. OCR identified potential violations of the HIPAA Security Rule in three specific areas:

No accurate, thorough risk analysis. OCR found Ambry had not conducted an accurate and thorough assessment of the potential risks and vulnerabilities to the electronic protected health information it held.

No process for cutting off access when it should have ended. OCR found Ambry lacked procedures for terminating a workforce member’s access to ePHI when their employment or other arrangement ended, or when their access was no longer appropriate for their role.

No unique user identification. OCR found Ambry hadn’t assigned unique names or numbers to identify and track individual user identity within systems containing ePHI — meaning activity inside those systems couldn’t necessarily be traced back to a specific person.

None of these three findings depended on a sophisticated attacker or a novel vulnerability. They’re baseline administrative and technical safeguards the HIPAA Security Rule has required for years. That’s precisely what makes this settlement useful as a case study rather than a cautionary tale about phishing sophistication.

Why the Sequence Matters More Than the Breach

It’s tempting to read this as “organization got phished, organization got fined.” That’s not quite the mechanism. In this case, the breach report triggered OCR’s investigation — but once OCR was looking, it wasn’t just evaluating how the breach happened. It was evaluating whether the organization could show it had already done the foundational compliance work the Security Rule requires, independent of whether that work would have stopped this particular attack.

That distinction reframes the practical question for any healthcare organization: it’s not “how do we stop the next phishing email” — useful as that is — but “if OCR opened an investigation into us tomorrow, could we produce a current, accurate risk analysis and show our access controls actually match our workforce today?”

This also isn’t an isolated pattern. OCR’s first-ever settlement centered specifically on a phishing-triggered breach was a $480,000 resolution with Lafourche Medical Group in December 2023, where the investigation similarly found no risk analysis had been conducted. A smaller $103,000 settlement with a treatment center in February 2026 followed the same shape: a phishing-compromised email account, and an OCR finding that no accurate, thorough risk analysis had been performed. The recurring issue isn’t just the phishing attack. It’s the missing risk analysis behind it.

What Ambry’s Corrective Action Plan Actually Requires

The corrective action plan gives a useful template for what OCR considers adequate remediation, since it’s the concrete list of what Ambry now has to do under two years of OCR monitoring: conduct a comprehensive and accurate risk analysis, build a risk management program to address the risks that analysis identifies, develop written policies and procedures to meet Security Rule requirements, assign unique identification to workforce members so activity in ePHI systems can be tracked, and provide HIPAA training to the workforce on those policies and procedures.

That list is also, functionally, a checklist for any practice or organization that wants to evaluate its own exposure before a regulator asks.

For healthcare organizations, HIPAA compliance is not only about responding to an incident — it is about having the documentation, policies, and controls to demonstrate compliance before an incident occurs. WCH helps healthcare providers strengthen compliance processes, conduct audits, and prepare for regulatory scrutiny by identifying gaps before they become costly.

What to Actually Check This Week

Pull your most recent risk analysis and check the date. Not your last HIPAA training session, not your cybersecurity insurance questionnaire — your actual, documented risk analysis of threats and vulnerabilities to ePHI. If you can’t quickly produce one that’s current and specific to your systems, that’s one of the clearest gaps to address, based on how consistently it appears in OCR’s phishing-related enforcement actions.

Audit your offboarding process, not just your onboarding process. Ask specifically: when someone leaves, changes roles, or a contractor’s engagement ends, how quickly does their access to systems containing ePHI actually get revoked, and is that step documented anywhere? A policy that exists on paper but isn’t consistently executed is exactly the kind of gap an investigation surfaces.

Confirm every user with access to ePHI has a unique login — not a shared one. Shared credentials or generic logins make it impossible to track who accessed what, which is precisely the gap OCR flagged here. This is a common shortcut in smaller practices, and it’s an easy one to fix relative to the exposure it creates.

Treat the risk analysis as a living document, not a one-time project. Systems change, staff change, vendors change. A risk analysis performed two or three years ago and never revisited is unlikely to reflect your current environment — and “we did one once” is a materially weaker position than “we maintain one.”

The uncomfortable truth in this settlement isn’t that phishing is dangerous. Everyone already knows that. It’s that the fine wasn’t really about the email — it was about what a regulator found, or didn’t find, when it went looking for the paperwork underneath.

Sources