Ambry Genetics Fined $700,000 After Phishing Exposed 225,370 Patients

The US Department of Health and Human Services’ Office for Civil Rights (OCR) has reached a $700,000 settlement with Ambry Genetics Corporation over potential violations of the HIPAA Security Rule. Ambry, a California-based provider of genetic testing and clinical genomics services, reported in March 2020 that an employee’s email account had been compromised in a phishing attack two months earlier.

The attacker may have accessed protected health information belonging to 225,370 people, including names, addresses, dates of birth, some Social Security or driving licence numbers, financial information, diagnoses, laboratory results, medication and treatment details.

OCR said its investigation identified potential failures in Ambry’s security controls. These included not carrying out an accurate and thorough risk analysis covering electronic protected health information, failing to terminate access when a workforce member’s employment ended or access was no longer appropriate, and failing to assign unique user names or numbers for identifying and tracking users of systems containing ePHI.

The findings concern potential HIPAA violations; the announcement does not state that OCR confirmed further exploitation beyond the reported phishing incident.

Under the resolution agreement, Ambry must follow a corrective action plan monitored by OCR for two years. It must conduct a comprehensive risk analysis, create a risk-management plan, review and revise its Security Rule policies, implement unique user identification across systems containing ePHI, and train its workforce on those policies and procedures.

OCR also highlighted measures including mapping where ePHI is stored and transferred, maintaining audit controls, reviewing system activity, authenticating users, encrypting ePHI where appropriate and incorporating lessons from incidents into security management.