On 17 September the HHS Office for Civil Rights announced a $700,000 settlement with Ambry Genetics over a phishing breach affecting 225,370 people. Read the findings and something stands out. OCR did not cite a single provision about how protected health information travelled. It cited who could reach it, and whether anyone had ever checked.
What actually happened
An attacker phished an employee’s email credentials and had access to that account from 22 to 24 January 2020. Ambry filed its breach report on 22 March 2020. The exposed data included names, addresses, dates of birth, driver’s licence numbers, diagnosis and treatment information, medications, and some Social Security numbers. The resolution is a settlement with a corrective action plan rather than a civil money penalty, and OCR monitors it for two years.
It is worth being precise about this, because it is easy to file it under the wrong heading. This was an account compromise. Email appears as the way in, not as the channel the records were sent over. Nobody was penalised for a misdirected document.
The three findings
Two of the three are identity controls. Unique user identification under 45 CFR 164.312(a)(2)(i), meaning every person who touches systems holding ePHI gets their own identifier. Termination procedures under 164.308(a)(3)(ii)(C), meaning access ends when someone leaves or no longer needs it. The third, risk analysis under 164.308(a)(1)(ii)(A), is the one that keeps turning up in every enforcement action OCR publishes.
The corrective action plan follows the same shape: a proper risk analysis, a risk management plan, Security Rule policies that get reviewed, unique user identification implemented across every system holding ePHI, and workforce training on all of it.
Every system holding ePHI includes the fax server
That phrase is where this stops being somebody else’s problem. A fax server holds ePHI in more places than most inventories admit. The spool directory while a job is queued. The rendered image after conversion. Delivery receipts that carry the recipient number and often the patient identifier. The archive, which in a lot of deployments goes back years because nobody set a retention rule.
If your last risk analysis listed the EHR, the imaging system and the file shares, and treated fax as a peripheral, that is exactly the gap OCR describes when it says an analysis was not compliant. We wrote about the analysis half of this in more detail recently, so this post stays on the identity half.
Where the shared login survives
Fax is unusually good at hiding shared credentials, because the workflow is physical. Somebody walks to a machine. The machine has one account. Everyone uses it.
The department login is the obvious one. Records, radiology, front desk, one password, often written down near the device because thirty people need it. Then the multifunction printer, which usually holds a single scan-to-fax service credential shared by everyone who walks up to it. Then the integration account, where the EHR or billing system sends through one API user, so every outbound fax carries the same author no matter who actually requested it.
The fourth is the leaver. HR closes the directory account, and the fax mailbox, the routing rule and the shared inbox membership all carry on working. That is 164.308(a)(3)(ii)(C) almost word for word.
Shared inboxes are fine. Shared credentials are not
This distinction gets lost and it matters. A shared inbox that several named people can open is normal and sensible, and nothing in the rule forbids it. What the rule asks is that the system can say which named person did a given thing. One set of credentials that thirty people type destroys that, and it destroys it permanently, because you cannot reconstruct the answer later from logs that only ever recorded a department.
At the device, card or PIN release solves it: the printer authenticates the person and passes that identity to the fax server, so the log names a human. For integrations, the service account authenticates as itself while the request carries the requesting user, which is a small change in how the API call is made and a large change in what the audit trail is worth.
The test that takes five minutes
Pick a fax your organisation sent six months ago and pull the record. If it names a person, you are in reasonable shape. If it names a department, a printer or an integration, you have found the same finding OCR cited, and you found it before an investigator did.
Do the same for a leaver. Take someone who left three months ago and check whether their fax mailbox still exists, whether inbound routing still points at them, and whether anyone would notice if a document arrived there tomorrow.
The stakes are being raised, slowly
On the same day as the Ambry announcement, Senators Ron Wyden and Mark Warner reintroduced the Health Infrastructure Security and Accountability Act. It would have HHS set mandatory minimum security standards rather than addressable ones, require annual stress tests and independent audits, and, notably, require an annual written attestation signed by the chief executive and the security officer.
It is a bill, not a rule, and reintroduced bills often go nowhere. But the attestation idea is worth sitting with. Signing your name to a statement about systems nobody has inventoried is a different proposition to filing a report, and unexamined fax infrastructure is precisely the sort of thing that makes a signature uncomfortable.
Frequently asked questions
Does HIPAA actually ban shared accounts?
It does not say so in those words. It requires unique user identification as a required implementation specification, which in practice means the system must be able to attribute activity to an individual. A shared credential makes that impossible, which is why it keeps appearing in enforcement findings.
We use a shared fax inbox for a whole department. Is that a problem?
Not by itself. The question is whether each person signs in as themselves before they open it. A shared mailbox with named access is fine. A shared password is the problem.
What about the multifunction printer in the corridor?
That is usually the weakest point, because the device holds one service credential and the walk-up workflow has no sign-in. Card or PIN release at the panel is the normal fix, and it needs the fax server to accept the identity the device passes rather than logging the device itself.
How far back does the archive need to be covered?
As far back as it goes. Old faxes are still ePHI, and an archive that nobody has applied a retention rule to is both a risk analysis finding and an access control one. Deciding a retention period is often the cheapest single improvement available.
Is $700,000 typical for this kind of case?
Settlement amounts vary a great deal with the size of the organisation and how it engaged with the investigation. The number is less instructive than the findings, because the findings tell you what OCR looked at, and those recur far more predictably than the penalties do.