HHS Civil Rights Office Resolves Ransomware Probe Involving Lehigh Valley Health Network

By
Office for Civil Rights (OCR)
October 29, 2026

United States Department Of Health And Human Services

Objective:

The article examines the objective, findings, and clinical context described in HHS Civil Rights Office Resolves Ransomware Probe Involving Lehigh Valley Health Network.

Approach:

Investigation: OCR investigated after LVHN reported a breach in May 2023 involving ransomware activity first identified on February 4, 2023.
Resolution: LVHN agreed to pay $800,000 and implement a corrective action plan monitored by OCR for three years.

Key Findings:

The attack resulted in exfiltration and dark-web posting of PHI affecting 248,359 individuals.
Exposed information included sensitive photographs of cancer patients receiving radiation oncology treatment, as well as identifying, financial, and medical information.
OCR determined LVHN may have violated HIPAA requirements concerning risk analysis, review of system activity, impermissible disclosure, and timely breach notifications.

Interpretation:

The agreement requires LVHN to conduct a comprehensive ePHI risk analysis, address identified risks, review and update HIPAA policies and procedures, and provide workforce training.

Limitations:

OCR described the identified HIPAA violations as potential noncompliance; the context does not report a final adjudication of liability.

Conclusion:

OCR stated that the resolution concludes its investigation. The source also lists security practices OCR recommends to regulated entities, including periodic risk analyses, audit controls, routine activity reviews, access authentication, appropriate encryption, and role-appropriate HIPAA training.