HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network

Settlement Marks OCR’s 22nd Ransomware Enforcement Action

WASHINGTON, D.C. — OCTOBER 29, 2026 — The United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR) today announced a settlement with Lehigh Valley Health Network (LVHN) and its affiliated covered entities concerning potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules. Under the terms of the resolution agreement, LVHN agreed to a three-year corrective action plan, and paid $800,000 to OCR.

On May 15, 2023, LVHN, a health system in Pennsylvania, filed a breach report stating that on February 4, 2023, LVHN discovered suspicious activity in their IT system that was subsequently determined to be ransomware. As a result of this ransomware attack, protected health information (PHI) was exfiltrated and posted on the dark web. The attack affected the PHI of 248,359 individuals and included sensitive photographs of cancer patients receiving radiation oncology treatment, names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, and treatment information.

“Failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks,” said OCR Director Paula M. Stannard. “The best defense against cyberattacks is full implementation of the HIPAA Security Rule.”

OCR enforces the HIPAA Privacy, Security, and Breach Notification Rules, which set forth the requirements that covered entities (health plans, healthcare clearinghouses, and most healthcare providers), and business associates must follow to protect the privacy and security of PHI.

The settlement resolves an investigation that OCR initiated after LVHN filed a breach report in May 2023. OCR found that LVHN had potentially violated provisions of the Privacy, Security, and Breach Notification Rules, including:

• Failing to conduct an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all of its electronic protected health information (ePHI);
• Failing to implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports;
• Impermissibly disclosing the PHI of 248,359 individuals;
• Failing to timely notify affected individuals of a breach of unsecured PHI; and
• Failing to timely notify the Secretary of HHS of a breach of unsecured PHI.

Under the terms of the resolution agreement, LVHN agreed to implement a corrective action plan that OCR will monitor for three years. Under the corrective action plan, LVHN has committed to taking steps to ensure compliance with the HIPAA Rules and protect the security of ePHI, including:

• Conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI;
• Develop and implement a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis;
• Review and, to the extent necessary, revise its current Privacy, Security, and Breach Notification Rule policies and procedures to comply with the HIPAA Rules;
• Review, and as necessary, develop or revise its training materials on the HIPAA Rules for all workforce members as necessary and appropriate for the performance of their job duties.

The resolution agreement and corrective action plan may be found here.

OCR recommends that regulated entities (healthcare providers, health plans, healthcare clearinghouses, and their business associates) take the following steps to mitigate or prevent cyber-threats:

• Identify where ePHI is located in the organization, including how ePHI enters, flows through, and leaves the organization’s information systems.
• Periodically conduct, and update as needed, a risk analysis and develop and implement a risk management plan to address identified risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
• Ensure audit controls are in place to record and examine information system activity.
• Implement regular review of information system activity.
• Utilize mechanisms to authenticate information to ensure only authorized users are accessing ePHI.
• Encrypt ePHI in transit and at rest to guard against unauthorized access to ePHI when appropriate.
• Incorporate lessons learned from incidents into the organization’s overall security management process.
• Provide workforce members with regular HIPAA training that is specific to the organization and to the workforce members’ respective job duties.

OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of individuals’ health information. The HIPAA Privacy Rule establishes national standards to protect individuals’ PHI; sets limits and conditions on the uses and disclosures of PHI; and gives individuals certain rights, including the right to timely access their health records. The HIPAA Security Rule establishes national standards to protect and secure our healthcare system by requiring administrative, physical, and technical safeguards to ensure the confidentiality, integrity, security, and availability of ePHI. The Risk Analysis provision requires regulated organizations (covered entities and their business associates) to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by that organization. Guidance about the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, and the Security Rule’s Risk Analysis requirement, can also be found on OCR’s website.

If you believe that your or another person’s health information privacy or security rights have been violated, you can file a complaint with OCR.

Follow HHS OCR on X at @HHSOCR. 
See OCR’s Newsroom here. 
Contact: HHS Press Office, 202-690-6343