Cybersecurity Policy Report, SETTLEMENT AGREEMENTS: OCR settles HIPAA investigation of Ambry Genetics phishing attack, (Sep 24, 2026)

By Donielle Tigay Stutland, J.D.

Federal investigators identified potential deficiencies involving risk analysis, workforce access termination, and unique user identification.

Ambry Genetics Corporation agreed to pay $700,000 and implement a corrective action plan to resolve an HHS Office for Civil Rights investigation into potential HIPAA Security Rule violations. The investigation followed a phishing attack that compromised an employee’s email account and may have involved the protected health information of 225,370 individuals. Under the settlement, OCR will monitor the company’s compliance with the corrective action plan for two years (Resolution Agreement between HHS and Ambry Genetics Corporation, Sept. 8, 2026).

The settlement stems from a January 2020 incident during which Ambry, which provides genetic testing and clinical genomics services, discovered that an employee’s email account was compromised by a phishing attack. The protected health information (PHI) of 225,370 individuals was potentially exfiltrated by the threat actor. Affected PHI included names, addresses, dates of birth, some Social Security numbers or driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, and treatment information.

“Email phishing is a common cyberattack that can lead to a breach of PHI and reveal HIPAA Security Rule deficiencies,” said OCR Director Paula M. Stannard in a press release. “Conducting a compliant risk analysis, engaging in risk management, and full implementation of the Security Rule provisions continue to be the foundation for effective cybersecurity and the best cyberdefense.”

Allegations. Following the discovery on January 22, 2020 that an Ambry email account was compromised by a targeted phishing attack that may have involved the protected health information (PHI) of 225,370 individuals, OCR found that Ambry had potentially violated provisions of the Security Rule, including:

• Failing to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the electronic protected health information (ePHI) held by Ambry;

• Failing to implement procedures for terminating access to ePHI when the employment of or other arrangement with a workforce member ends or access is no longer appropriate; and

• Failing to assign a unique name and/or number for identifying and tracking user identity in electronic systems containing ePHI.

Settlement Terms. The settlement resolves an investigation that OCR initiated after Ambry filed a breach report in March 2020 about the phishing incident that occurred in January 2020. Under the terms of the resolution agreement, Ambry agreed to implement a corrective action plan that OCR will monitor for two years and paid $700,000 to OCR. Under the corrective action plan, Ambry has committed to taking steps to ensure compliance with the HIPAA Rules and protect the security of ePHI, including:

• Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;

• Develop and implement a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis;

• Develop, review and, to the extent necessary, revise its current Security Rule policies and procedures to comply with the HIPAA Rules;

• Implement unique user identification in all its information systems that contain ePHI; and

• Ensure that all workforce members are trained with respect to its Security Rule policies and procedures.

The Agreement is not an admission of liability by Ambry, nor is it a concession by HHS that Ambry is not in violation of the HIPAA Rules and not liable for civil money penalties.

CIAsSettlementAgreements: SettlementAgreementsNews CyberPrivacyFeed EnforcementNews HIPAANews DataSecurity DataBreach LitigationEnforcement DataPrivacy