Logged But Never Reviewed: The HIPAA Monitoring Failure Behind OCR’s Latest Settlements
A phishing email compromised one employee email account at Ambry Genetics Corporation in January 2020. The incident ultimately affected approximately 225,370 individuals and led to a $700,000 settlement with the U.S. Department of Health and Human Services Office for Civil Rights (OCR).
The settlement, announced on September 17, 2026, also requires Ambry to operate under a two-year corrective action plan monitored by OCR.
The phishing attack started the chain reaction. But OCR’s findings show what made the consequences so severe: three foundational HIPAA Security Rule failures that should have been identified through a proper risk analysis.
Those failures involved:
- An inaccurate and incomplete security risk analysis
- Missing procedures to terminate workforce access
- A lack of unique user identification
For healthcare organizations and business associates, this is the critical lesson: phishing is often the trigger, not the root cause.
THE INCIDENT WAS PHISHING. THE ENFORCEMENT FAILURE WAS STRUCTURAL.
Ambry Genetics reported that a phishing attack compromised an employee email account in January 2020. The exposed environment contained electronic protected health information (ePHI) belonging to more than 225,000 individuals.
Potentially affected information included sensitive personal and health-related data. Ambry reported the breach to OCR in March 2020, leading to an investigation into whether the company had implemented the safeguards required by the HIPAA Security Rule.
OCR identified three deficiencies:
- Ambry had not performed an accurate and thorough risk analysis of risks to ePHI.
- Ambry lacked procedures to terminate access to ePHI when workforce members left or changed roles.
- Ambry had not consistently assigned unique user identifiers to individuals accessing systems containing ePHI.
The result was not simply a breach notification. It was a financial settlement, a mandatory remediation program, ongoing documentation obligations, and two years of regulatory oversight.
A security incident exposed the weakness. A deficient compliance program magnified it.
FAILURE #1: THE RISK ANALYSIS DID NOT ACCURATELY MAP THE REAL RISK
Under 45 CFR 164.308(a)(1)(ii)(A), covered entities and business associates must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
This is not a one-time checklist exercise. It is the foundation for every other Security Rule decision.
A meaningful risk analysis should identify:
- Where ePHI is created, received, maintained, and transmitted
- Which systems, applications, devices, and accounts can access ePHI
- How email and cloud services expose the organization to compromise
- Which workforce members and vendors have access
- What happens when an account is compromised
- Whether logging and monitoring can support an investigation
- Which vulnerabilities could enable unauthorized access or disclosure
If the analysis is incomplete, the organization may believe it has addressed its greatest risks while leaving basic exposure points untouched.
That is the problem OCR’s Ambry findings highlight. The company experienced a phishing attack, but the deeper issue was that its risk analysis did not identify and drive remediation for weaknesses involving access termination and user accountability.
A risk analysis that does not change security decisions is not risk management.
What healthcare organizations should verify
Ask these questions:
- Does our risk analysis include email, identity systems, remote access, and cloud platforms?
- Does it document risks to ePHI, not just general IT risks?
- Does it identify former employees and inactive accounts as access risks?
- Does it evaluate whether individual activity can be attributed to a specific user?
- Does it include documented risk owners, remediation deadlines, and validation steps?
- Is it updated when systems, vendors, workflows, or threats change?
If the answer is “we completed an assessment several years ago,” the organization may have documentation, but not an active risk management program.
FAILURE #2: ACCESS DID NOT END WHEN THE WORK RELATIONSHIP ENDED
The second finding involved 45 CFR 164.308(a)(3)(ii)(C), which requires covered entities and business associates to implement procedures for terminating access to ePHI when a workforce member’s employment or other arrangement ends.
This requirement is straightforward. Execution is where organizations fail.
Access termination must account for more than disabling a primary network account. A departing employee may still have access through:
- Email and collaboration platforms
- Electronic health record systems
- Laboratory information systems
- Cloud storage
- Remote access tools
- Shared applications
- Mobile devices
- Vendor portals
- Privileged administrative accounts
- Saved browser sessions or active tokens
Role changes create a similar risk. An employee who moves from one department to another may retain access that is no longer appropriate for the new position.
A documented offboarding process should connect human resources, managers, IT, security, and application owners. It should define who acts, what systems are reviewed, how quickly access is removed, and how completion is evidenced.
A practical termination control
Build a formal joiner-mover-leaver process:
- Trigger: HR or management records a termination or role change.
- Authority: A designated owner confirms the effective date and scope.
- Execution: IT disables accounts, revokes sessions, removes group memberships, and collects devices.
- Application review: System owners verify access in ePHI repositories and third-party platforms.
- Validation: Security or management confirms completion.
- Evidence: The organization retains a timestamped record of the actions taken.
The process must work during nights, weekends, leave periods, and urgent terminations, not only during normal business hours.
FAILURE #3: USERS COULD NOT BE UNIQUELY IDENTIFIED
The third deficiency involved 45 CFR 164.312(a)(2)(i), which requires the implementation of a unique user identification procedure for electronic systems containing ePHI.
Every person accessing ePHI should use an identifier that is unique to that individual.
This requirement is central to accountability. It enables an organization to determine:
- Who accessed a record
- Which user sent or opened an email
- Who changed a system setting
- Whether activity was authorized
- When suspicious behavior began
- Which accounts require investigation
Shared accounts, generic usernames, and informal credential practices weaken that chain of evidence. They also make it harder to contain a breach and prove that access controls are working.
Unique user identification does not stop every phishing email. It does something equally important: it limits ambiguity after an incident.
When an organization cannot reliably attribute activity to a person, it loses visibility at the exact moment investigators, executives, attorneys, insurers, and regulators need answers.
Close the identity-control gap
Healthcare organizations and business associates should:
- Eliminate shared accounts wherever technically feasible
- Assign individual usernames to workforce members and contractors
- Require strong authentication for systems containing ePHI
- Review privileged accounts separately from standard accounts
- Disable inactive accounts promptly
- Reconcile accounts against current HR and workforce records
- Review access logs for anomalous activity
- Document exceptions and compensating controls
- Test whether logs identify users consistently across critical systems
Unique identification should be paired with least privilege, timely termination, and effective audit logging. One control cannot compensate for the absence of the others.
THE OCR PATTERN: BASIC CONTROLS, SERIOUS CONSEQUENCES
The Ambry settlement reflects a recurring pattern in HIPAA enforcement.
Organizations often focus on the sophistication of an attack. OCR focuses on whether the organization understood its environment, managed access, and maintained reasonable safeguards before the incident occurred.
The same foundational questions repeatedly surface:
- Did the organization know where ePHI was stored?
- Did it understand who could access that information?
- Did it remove access when people left?
- Could it identify individual activity?
- Did it document and manage known risks?
- Could it demonstrate that its safeguards were operating?
These are not advanced or speculative requirements. They are core security hygiene.
That is why a single phishing email can become a major enforcement event. The email may be simple. The underlying control failures may affect the entire organization.
THE PROPOSED HIPAA SECURITY RULE MAKES THIS DIRECTION CLEARER
HHS’s proposed HIPAA Security Rule update is not yet final, and the existing Security Rule remains in effect. However, the proposed changes point toward more formalized cybersecurity expectations.
The proposal includes measures involving:
- Technology asset inventories
- Network maps showing ePHI movement
- More specific risk analysis requirements
- Written documentation and recurring review
- Multi-factor authentication
- Encryption
- Vulnerability scanning
- Penetration testing
- Incident response planning
- Regular testing of security measures
Organizations should not wait for a final rule to address the weaknesses identified in the Ambry case.
The current requirements already demand risk analysis, access control, workforce security, and unique user identification. Preparing now also creates a stronger foundation for future regulatory expectations.
Read the HHS proposed HIPAA Security Rule update and compare its direction with your current security program.
A PRACTICAL HIPAA SECURITY CHECKLIST
Use this checklist to assess whether your organization is prepared:
Risk analysis
- Maintain an accurate inventory of systems that create, receive, maintain, or transmit ePHI.
- Identify threats and vulnerabilities affecting email, identity, endpoints, cloud services, and vendors.
- Document likelihood, impact, risk owners, and remediation deadlines.
- Update the analysis after major technology, workforce, or business changes.
- Validate that risk treatment activities are actually completed.
Workforce access
- Maintain documented termination and role-change procedures.
- Define required actions for every critical application.
- Revoke sessions, tokens, remote access, and privileged access.
- Reconcile active accounts against current workforce records.
- Retain evidence that access termination was completed and reviewed.
User identification
- Assign unique identifiers to all users accessing ePHI.
- Eliminate shared credentials or document approved exceptions.
- Review privileged and service accounts.
- Enable logging that attributes activity to individual users.
- Monitor for inactive, duplicate, orphaned, or suspicious accounts.
Ongoing oversight
- Test phishing resilience and identity controls.
- Review security logs and investigate anomalies.
- Conduct tabletop exercises for compromised-account scenarios.
- Track remediation through executive-level reporting.
- Maintain audit-ready evidence of policies, procedures, testing, and decisions.
BUILD A SECURITY PROGRAM THAT HOLDS UNDER SCRUTINY
Cenova Cyber helps healthcare organizations and business associates move beyond policy-based compliance.
Our HIPAA Compliance services help identify risks to PHI, build practical remediation plans, strengthen access controls, and support continuous monitoring and evidence collection.
Our vCISO services provide executive-level security leadership for organizations that need a clear owner for cybersecurity strategy, compliance, risk reporting, incident response planning, and remediation oversight.
A proper Security Risk Assessment should do more than produce a report. It should show leadership:
- What can go wrong
- Which ePHI is exposed
- How likely the event is
- What the financial and operational impact could be
- Which controls reduce the risk
- Who owns the work
- How progress will be measured
Schedule a free HIPAA Security Risk Assessment consultation with Cenova Cyber today. We will help you evaluate your current risk analysis, workforce termination procedures, unique user identification controls, and readiness for OCR scrutiny. Before a phishing email turns a preventable gap into a costly enforcement action.