Briefing
HHS OCR announced a $700,000 settlement with Ambry Genetics on September 17, 2026. A single phishing email in January 2020 gave an attacker roughly two days in one employee's mailbox, exposing protected health information of 225,370 people. OCR's three findings were a missing risk analysis, no procedures for terminating access, and no unique user identification.
The second and third findings show up in many small organizations, regulated or not. Former staff keep working logins because nobody owns the departure process. Shared accounts make logs useless because no entry points to one person.
What to do
- Keep a system access register: every application that holds sensitive data and the people who can reach it.
- Trigger a checklist on every departure and role change, with an owner and a same-day deadline.
- Disable accounts, revoke tokens and sessions, rotate any shared secrets the person knew, and recover or wipe company devices.
- Remove company email and files from personal phones.
- Replace shared logins with named accounts. Use fast user switching or short timeouts where workflow demands speed.
- Turn on MFA for email and remote access.
How to verify
- For the most recent departure, produce timestamps for each disabled account.
- Export user lists from your top three systems and reconcile them against HR records.
- Search logs for activity by any account belonging to a former employee after their last day.
Sources
- HHS OCR, Settlement with Ambry Genetics, Sep 17, 2026
- Nixon Peabody, HIPAA settlement reminds organizations to focus on security, Sep 21, 2026
- CISA, Require Multifactor Authentication
Want help putting this in place? Contact Computer Plus.