Lehigh Valley Health Network (LVHN) has paid $800,000 to settle an investigation by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) following a ransomware attack that exposed sensitive patient information.

Announced on October 29, 2026, the settlement addresses potential violations of the HIPAA Privacy, Security, and Breach Notification Rules involving LVHN and its affiliated covered entities. The Pennsylvania health system also agreed to a corrective action plan that OCR will monitor for three years.

Ransomware Attack Affected 248,359 Individuals

LVHN discovered suspicious activity in its information technology system on February 4, 2023. Further investigation identified ransomware and confirmed that protected health information (PHI) had been stolen and posted on the dark web. LVHN submitted its breach report to HHS on May 15, 2023.

The breach affected 248,359 individuals. The exposed information included:

  • Names, addresses, and dates of birth.
  • Social Security numbers and driver’s license numbers.
  • Financial information.
  • Diagnoses, medical conditions, laboratory results, medications, and treatment information.
  • Sensitive photographs of cancer patients receiving radiation oncology treatment.

What OCR Identified During Its Investigation

OCR’s investigation identified five areas of potential HIPAA noncompliance:

  • Incomplete risk analysis. LVHN had not conducted an accurate and thorough analysis of the risks and vulnerabilities affecting the confidentiality, integrity, and availability of all its electronic protected health information (ePHI).
  • Insufficient review of system activity. LVHN had not implemented procedures to regularly review audit logs, access reports, and security incident tracking reports.
  • Impermissible disclosure of patient information. The ransomware attack resulted in the disclosure of PHI belonging to 248,359 individuals.
  • Delayed notification to affected individuals. LVHN did not provide timely notification of the breach to affected individuals.
  • Delayed reporting to HHS. LVHN did not notify the Secretary of HHS within the required timeframe.

The resolution agreement states that the settlement is not an admission of liability by LVHN.

What the Corrective Action Plan Requires

In addition to the settlement payment, LVHN agreed to take steps to strengthen its HIPAA compliance and protect electronic patient information.

The corrective action plan includes four main areas:

  1. Conduct a thorough risk analysis. Identify and assess risks and vulnerabilities affecting the confidentiality, integrity, and availability of ePHI.
  2. Develop and implement a risk management plan. Address the security risks and weaknesses identified through the risk analysis.
  3. Review and update HIPAA policies and procedures. Revise Privacy, Security, and Breach Notification Rule policies where needed to meet HIPAA requirements.
  4. Review and update workforce training. Ensure HIPAA training materials reflect employees’ responsibilities and the information they handle.

OCR will monitor LVHN’s compliance with the corrective action plan for three years.

Steps Organizations Can Take to Reduce Cybersecurity Risks

Alongside the settlement announcement, OCR recommended several measures for healthcare providers, health plans, healthcare clearinghouses, and their business associates.

Organizations should:

  • Know where electronic patient information is stored and shared. Identify where ePHI is located and how it enters, moves through, and leaves the organization’s systems.
  • Keep risk analyses current. Periodically assess security risks, update the analysis when needed, and implement a plan to address identified vulnerabilities.
  • Use audit controls. Ensure systems can record and support examination of activity involving ePHI.
  • Review system activity regularly. Examine audit logs, access reports, and security incident records.
  • Verify user identities. Use authentication measures to help ensure that only authorized users can access ePHI.
  • Protect information with encryption when appropriate. Apply encryption to ePHI while it is stored and while it is transmitted.
  • Apply lessons from security incidents. Use what the organization learns from incidents to improve its security management process.
  • Provide regular, relevant HIPAA training. Tailor training to the organization’s operations and each workforce member’s job duties.

In the announcement, OCR Director Paula M. Stannard emphasized the importance of thorough risk analysis and routine system activity reviews, stating: “The best defense against cyberattacks is full implementation of the HIPAA Security Rule.”

Read the official HHS announcement and the resolution agreement and corrective action plan for additional details.