Ambry Genetics Settles HIPAA Violations After Phishing Attack Exposes PHI

• •Ambry Genetics settled for $700,000 due to HIPAA violations from a phishing attack.
• •The breach affected the PHI of 225,370 individuals, including sensitive personal data.
• •The HHS OCR emphasized the importance of risk analysis and management in cybersecurity.

On September 17, 2026, the HHS Office for Civil Rights announced a settlement with Ambry Genetics regarding HIPAA Security Rule violations. The company, which provides genetic testing services, reported a phishing attack in January 2020 that compromised an employee's email account. This breach potentially exposed the protected health information (PHI) of 225,370 individuals, including names, addresses, and Social Security numbers. The OCR found that Ambry failed to conduct a thorough risk analysis and did not properly manage access to ePHI. As part of the settlement, Ambry agreed to pay $700,000 and implement a corrective action plan monitored over two years. The incident highlights the ongoing risks associated with email phishing in the healthcare sector.