Healthcare breaches do not always begin with ransomware or a sophisticated attack against a medical server. Sometimes the entry point is one employee mailbox.
In September 2026, the U.S. Department of Health and Human Services announced a settlement involving Ambry Genetics after an investigation into a 2020 phishing incident. HHS says an employee email account was compromised and protected health information belonging to 225,370 people was potentially exfiltrated.
Why the mailbox matters
Email can contain referrals, reports, attachments, billing information, conversations with patients and credentials or reset links for other systems. A compromised mailbox can therefore become both a data source and a launch point for further impersonation.
Practical controls for clinics
Use phishing-resistant MFA where possible. Protect clinical and administrative accounts, especially privileged users.
Reduce unnecessary sensitive information in email. Data that does not need to remain in a mailbox should not become permanent exposure.
Monitor sign-ins and mailbox changes. Unexpected forwarding rules, authentication changes and unusual access deserve investigation.
Have an account-compromise procedure. Know how to revoke sessions, reset authentication, preserve evidence and determine what information may have been accessed.
Review access when roles change. Offboarding and least privilege are basic controls with major consequences.
Source: U.S. Department of Health and Human Services, Office for Civil Rights, Ambry Genetics settlement announcement, September 17, 2026.
Simple IT. Strong Security. — CyberEase
Need help strengthening your business security?
CyberEase provides practical IT and cybersecurity support for small businesses, professional offices and clinics.