What happened
On September 17, 2026, the HHS Office for Civil Rights announced a settlement with Ambry Genetics Corporation, a California based provider of genetic testing and clinical genomics services. The release says the PHI of 225,370 individuals was potentially exfiltrated after a January 2020 phishing attack on an employee’s email account.
OCR said Ambry potentially violated the Security Rule in three ways: it did not conduct an accurate and thorough risk analysis, it did not implement procedures for ending access to ePHI when access is no longer appropriate, and it did not assign a unique name or number to identify and track user identity in systems containing ePHI.
Ambry paid $700,000 to OCR and agreed to a corrective action plan that OCR will monitor for two years. The release describes the findings as potential violations and does not state whether Ambry admitted liability, and we are not characterizing it either way.
Analysis: The risk analysis finding appears again, but the other two findings are practical and close to home. Ending access when someone leaves or changes roles is an offboarding question, and unique identifiers are a question of whether every person who touches records logs in as themselves. ABA clinics have more turnover than most practices, with technicians, supervisors and administrative staff moving in and out, and shared logins on tablets and session note systems are a familiar shortcut. A clinic owner can test both quickly: ask for the list of every account that can open client records and match it against the current staff list, and check whether any login is shared. This is reporting, not legal advice.
About the settlement figure: it is the amount paid to OCR. It does not include the entity's own costs of responding, such as staff time, outside advisers and remediation, or any private claims.
Compliance you can actually show.
WiseUpHIPAA is built for ABA clinics. It works out what applies to you, holds your decisions and the evidence behind them, and shows you honestly where you stand, including the parts that are not done yet.