Pennsylvania Health System Pays $800 to Resolve Alleged HIPAA Violations
An investigation of a ransomware attack on Lehigh Valley Health Network uncovered violations of the HIPAA Privacy, Security, and Breach Notification Rules. The Pennsylvania health system has agreed to settle the alleged HIPAA violations with the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and has paid an $800,000 financial penalty.
The ransomware attack was as bad as it gets for patients. Their sensitive, protected health information was stolen and was leaked online, which, for certain cancer patients undergoing radiation oncology treatment, included naked images. The severity of the attack was reflected in the size of the class action data breach settlement. Lehigh Valley Health Network agreed to pay $65 million to resolve claims related to the attack.
The BlackCat ransomware group compromised parts of the Lehigh Valley Health Network, including data related to Delta Medix, a company that Lehigh Valley Health Network acquired in 2021. Suspicious activity was identified within its network on February 4, 2023, and the investigation confirmed that ransomware was used to encrypt files.
Data was exfiltrated prior to file encryption. The data review confirmed that 248,359 individuals were affected and had personal and protected health information compromised, including names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, treatment information, and naked photographs. Lehigh Valley Health Network opted not to pay the ransom, and the BlackCat group leaked the stolen data.
OCR investigates all large breaches of unsecured protected health information to determine if the incident occurred as a result of noncompliance with the HIPAA Rules. OCR launched its investigation in response to a May 15, 2026, breach notification. OCR’s investigation identified noncompliance with the risk analysis provision of the HIPAA Security Rule. Lehigh Valley Health Network had not conducted a HIPAA-compliant risk analysis to identify all risks and vulnerabilities to patient data.
There was also a lack of Security Rule-mandated policies and procedures for regular reviews of logs of activity in information systems containing patient data, and a HIPAA Privacy Rule violation – the impermissible disclosure of the protected health information of 248,359 individuals.
When a HIPAA-regulated entity experiences a breach of unsecured protected health information, the incident must be reported to OCR and the affected individuals must be notified. Notifications must be issued within 60 days of the discovery of a data breach. OCR determined that both of these requirements of the HIPAA Breach Notification Rule were violated.
When alleged HIPAA violations are settled, in addition to a financial penalty, the regulated entity is required to adopt a corrective action plan to address the noncompliance. Lehigh Valley Health Network has agreed to adopt a corrective action plan and will be monitored for compliance by OCR for 3 years. The corrective action plan requires a HIPAA-compliant risk analysis, a risk management plan to reduce the identified risks to a low and acceptable level, a review and update of its HIPAA policies and procedures, and HIPAA training for the workforce.
This is OCR’s 12th HIPAA compliance case this year to result in a financial penalty, and its 22nd investigation of a ransomware-related data breach. OCR has collected $3,970,250 from its HIPAA enforcement activities so far this year.
