Signal of the Day · Security & AI Risk
OCR settles HIPAA Security Rule case for $700,000 over unique-user-ID and access-termination failures
What happenedOCR settled with Ambry Genetics for $700,000 over a 2020 phishing breach affecting 225,370 people, citing no risk analysis, no access termination and no unique user IDs.
Why it mattersNo AI was involved; in the wire's analysis, not OCR's, unique IDs and deprovisioning are what strain when AI agents share service accounts or keep tokens.
For leadersGive each AI agent its own identity and end its access with the workflow — the controls HIPAA already expects for the workforce.