U.S. Health Department Lists Missing Offboarding as a Potential Violation
1The Investigation Began With a Phishing Attack in 2020
On September 17, 2026, the Office for Civil Rights at the U.S. Department of Health and Human Services announced a $700,000 settlement with Ambry Genetics, a genetic testing provider. The settlement resolves potential violations of the Security Rule under the Health Insurance Portability and Accountability Act (HIPAA). Among those the regulator lists is the lack of procedures for ending a worker's access to electronic patient data, which the regulator calls ePHI, when their employment ends. The regulator opened the investigation after Ambry reported a January 2020 phishing attack on an employee's email account, which potentially exfiltrated the health data of 225,370 people. The listed findings do not describe the phishing email itself. Two of them concern how access is tracked and ended.
Failing to implement procedures for terminating access to ePHI when the employment of or other arrangement with a workforce member ends or access is no longer appropriate
Office for Civil Rights, U.S. Department of Health and Human Services, announcement of the Ambry Genetics settlement
The regulator also lists the lack of an accurate and thorough risk analysis and of a unique name or number for identifying and tracking each user. The release ties the breach to phishing and does not say how the regulator reached the termination finding.
2Ambry Must Identify Each User in Every System Holding Patient Data
Under the HIPAA Security Rule as it stands, unique user identification is required, while termination procedures are addressable. For an addressable safeguard, an organization assesses whether it is reasonable and appropriate. It then adopts the safeguard or documents why not and, where reasonable and appropriate, puts an equivalent measure in place. Ambry paid $700,000 and agreed to a corrective action plan that the regulator will monitor for two years. Its commitments include unique user identification in all its information systems that contain patient data. Ambry will also revise its Security Rule policies and procedures where necessary and train its workforce on them.
Conducting a compliant risk analysis, engaging in risk management, and full implementation of the Security Rule provisions continue to be the foundation for effective cybersecurity and the best cyberdefense.
Paula M. Stannard, Director, Office for Civil Rights
The regulator's recommended steps for HIPAA-regulated organizations include audit controls that record information system activity, regular review of that activity and authentication mechanisms that ensure only authorized users access patient data. On September 23, 2026, two federal agencies made a related recommendation for industrial operators, asking them to apply least privilege to third-party integrators.
Source: Office for Civil Rights, U.S. Department of Health and Human Services, HHS' Office for Civil Rights Settles HIPAA Investigation of Ambry Genetics Phishing Attack Affecting 225,000 Individuals, September 17, 2026.