Amgen detected unauthorized activity in July targeting data stored in cloud environments hosted by external service providers. Attackers exfiltrated proprietary company data, patients' protected health information, and other sensitive records. The biotechnology company filed with the Securities and Exchange Commission, noting no disruption to manufacturing operations or medicine supply, but the investigation remains ongoing as they assess the full scope of compromised intellectual property and research data.
This incident reveals a pattern healthcare compliance officers can't ignore: your third-party cloud providers represent your largest uncontrolled attack surface.
What the Data Shows
Third-party breaches bypass your controls entirely. When attackers compromise your cloud service provider, they circumvent every perimeter control, endpoint detection tool, and security awareness training program you've deployed. You're dependent on vendor security practices you may have reviewed once during procurement, then never validated again.
Detection happens weeks or months late. Amgen identified the July breach activity and disclosed it in a September SEC filing. That detection gap isn't unusual. In third-party environments, you rely on the vendor's logging, monitoring, and incident response capabilities. If their security operations center misses the initial compromise, you won't know until data appears on a leak site or regulators come asking questions.
Protected health information exposure triggers HIPAA obligations regardless of where data lives. The Health Insurance Portability and Accountability Act doesn't exempt breaches that occur at business associates or their subcontractors. When Amgen notifies affected patients, they'll do so under HIPAA Breach Notification Rule requirements: individual notification without unreasonable delay, media notification if the breach affects more than 500 residents of a state, and Department of Health and Human Services notification within 60 days.
Intellectual property theft creates long-term competitive damage. Amgen is still assessing whether research and development data was accessed. For biotechnology companies, proprietary research represents years of investment and competitive advantage. Unlike compromised credentials you can rotate or systems you can rebuild, stolen intellectual property stays stolen.
Operational continuity doesn't mean compliance success. Amgen emphasized that manufacturing, financial reporting, and medicine supply remained unaffected. That operational resilience matters for business continuity, but it doesn't satisfy your regulatory obligations. The HIPAA Security Rule requires you to protect electronic protected health information wherever it's created, received, maintained, or transmitted, including at business associates.
What This Means for Your Team
You're accountable for security failures at vendors you don't control. When your cloud provider suffers a breach, your patients still lose privacy, your intellectual property still gets stolen, and your organization still faces regulatory scrutiny.
The business associate agreement you signed doesn't transfer liability. It creates shared responsibility. Under HIPAA, you remain a covered entity with direct obligations. Your vendor's security failure becomes your compliance failure.
Your current vendor risk assessment process probably checks boxes without measuring actual security posture. Consider what you know right now about the cloud environments hosting your most sensitive data:
- When did you last review their SOC 2 Type II report, and did you read the complementary user entity controls section that lists your responsibilities?
- Do you receive security incident notifications from them within defined timeframes?
- Can you access logs showing who accessed your data and when?
- Do you have contractual rights to audit their security controls or review third-party penetration test results?
- What's their mean time to detect and respond to security incidents?
If you can't answer these questions for every vendor processing protected health information, you're operating on trust instead of verification.
Action Items by Priority
Immediate (This Quarter):
Inventory every third-party system that stores, processes, or transmits protected health information or proprietary data. Create a spreadsheet with vendor name, data types, contract renewal date, and last security assessment date. You can't manage risks you haven't identified.
Request current SOC 2 Type II reports from your top five vendors by data sensitivity. Read the auditor's opinion section and the complementary user entity controls. Those controls are your responsibility to implement, not the vendor's. If a vendor can't provide a recent SOC 2 Type II report, that's a red flag requiring immediate escalation.
Review your business associate agreements for security incident notification requirements. HIPAA requires business associates to report breaches of unsecured protected health information to covered entities without unreasonable delay and no later than 60 days after discovery. If your contracts don't specify faster notification windows, you're learning about breaches too late to meet your own notification obligations.
Near-Term (Next Two Quarters):
Implement continuous vendor risk monitoring for critical providers. Annual questionnaires don't catch emerging vulnerabilities. Use automated tools that monitor for security incidents, regulatory actions, and control failures at your vendors. When a vendor suffers a breach, you need to know immediately so you can assess impact to your data.
Define and document your complementary user entity controls for each cloud service. The SOC 2 Type II report tells you what security controls you must implement to achieve the intended control objectives. Document how you're meeting these requirements. During your next HIPAA Security Rule audit, you'll need evidence that you implemented required safeguards even for outsourced functions.
Establish vendor security performance metrics in contracts. Move beyond "commercially reasonable security measures" language. Specify mean time to detect, mean time to respond, log retention periods, and security incident notification timeframes. Make these measurable obligations with defined consequences for failure.
Strategic (Next Year):
Build a third-party incident response playbook. When your vendor calls to report a breach, you need predefined steps: who gets notified internally, how you assess data impact, when you engage legal counsel, how you meet HIPAA notification timelines, and what evidence you preserve for regulatory inquiries. Practice this playbook with tabletop exercises that simulate vendor breach scenarios.
Negotiate contractual audit rights that let you verify vendor security controls. The right to audit doesn't mean you'll audit every vendor annually, but it creates leverage. Vendors who refuse audit rights are telling you they're not confident in their security posture.
Evaluate data residency and encryption key management. If you control encryption keys and vendors only access encrypted data, you reduce breach impact. This architectural change requires planning and investment, but it shifts the risk calculus significantly.
