Briefing
On September 17, 2026, the HHS Office for Civil Rights announced a $700,000 settlement with Ambry Genetics. One employee answered a phishing email in January 2020, an attacker had access to that mailbox for about two days, and protected health information for 225,370 people was exposed. OCR listed three potential Security Rule violations: no accurate and thorough risk analysis, no procedures for terminating access, and no unique user identification.
Most offboarding checklists stop at email and the practice management system. In the offices we support, access also lives in the phone system: a voicemail box that still receives patient callbacks, a shared extension login at the front desk, a fax-to-email route that forwards to a former employee, and a softphone app on a personal phone. Each of these can carry patient information and each needs an owner.
Texas adds its own clock. Health and Safety Code 181.101 requires privacy training within 90 days of hire, a signed acknowledgment, and retention of that record for six years. Business and Commerce Code 521.053 requires notice to affected individuals within 60 days of determining a breach, and notice to the Texas Attorney General within 30 days when 250 or more Texans are affected.
What to do
- Build one inventory of systems that touch patient data, including the PBX, voicemail, fax routes, call recordings and mobile softphones.
- Give every person their own login on each system. Replace shared front desk and extension logins with named accounts and short session timeouts.
- Write a departure checklist with a named owner and a same-day target: disable accounts, reset voicemail PINs, reassign the extension, remove softphone and email from personal devices, rotate any shared passwords.
- Turn on MFA for email and every remote path. The Ambry incident began with a phished password.
- Keep the signed Texas training acknowledgments with hire dates so the 90 day requirement can be shown.
How to verify
- Pick the last person who left. Produce the dated record showing when each account, voicemail box and device was disabled or reassigned.
- Export user lists from the phone system and the practice management system and confirm no account is shared or orphaned.
- Spot check three employees hired in the last year for a signed training statement dated within 90 days of hire.
- Confirm fax and voicemail-to-email routes point only to current staff.
Sources
- HHS OCR, Settlement with Ambry Genetics, Sep 17, 2026
- Nixon Peabody, HIPAA settlement reminds organizations to focus on security, Sep 21, 2026
- Texas Health and Safety Code Section 181.101
- Texas Business and Commerce Code Section 521.053
- Texas Attorney General, Data Breach Reporting
- CISA, Require Multifactor Authentication
Questions about your phones, network or IT? Contact Texwan.