The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has reached a settlement with the healthcare network over potential HIPAA violations.

 

What happened

On October 29th, 2026, the HHS released a statement about its 22nd Ransomware Enforcement Action, which took place against Lehigh Valley Health Network (LVHN) and its affiliated covered entities. The statement outlines the HHS’ investigation and the corrective action plan LVHN will be expected to follow.

The settlement comes after the OCR initiated an investigation following a data breach report filed by LVHN. Under the terms, LVHN will be required to pay an $800,000 fine to the OCR and will be placed on a corrective action plan for three years.

 

Going deeper

During the investigation, the OCR sought to understand if LVHN had violated provisions prior to experiencing a data breach in May of 2023. The investigation found that LVHN had:

  • Failed to conduct an accurate and thorough risk analysis that would have revealed potential risks and vulnerabilities to cyber threats,
  • Failed to implement a regular review process for records of information system activity (security incident tracking, audit logs, etc),
  • Impermissibly disclosing the PHI of 248,359,
  • Failing to notify impacted individuals in a timely manner, and
  • Failing to notify the HHS of the data breach in a timely manner.

 

The backstory

LVHN faced a data breach in early 2023. According to their breach notice, they discovered suspicious activity on February 4th, 2023, and ultimately determined that 248,359 individuals were impacted. Data involved included photographs of patients receiving treatment, names, addresses, Dates of Birth, Social Security numbers, driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, and treatment information.

The breach was claimed by the notorious ransomware group ALPHV (also known as BlackCat or Noberus), a Russian-speaking group known for operating a prominent Ransomware-as-a-Service model. Uniquely, LVHN acknowledged that this group was responsible for the incident. The group has claimed over 700 victims but has been inactive since March of 2024, after the Department of Justice released a decryption tool that largely disrupted the organization. Nevertheless, the malicious organization has impacted healthcare organizations around the world, with one of their most well-known attacks causing huge disruptions for Change Healthcare, which impacted an estimated one-third of Americans.

 

In the know

For LVHN, the settlement with the HHS was not their only financial repercussion; the health network also faced a $65 settlement in the class action suit Jane Doe v. Lehigh Valley Health Network, Inc., in Lackawanna County Court of Common Pleas. The settlement had its final approval hearing in November of 2024 and victims received their payments between the spring of 2025 and the spring of 2026.

LVHN also underwent a merger with Jefferson Health in a $14 billion deal that would allow the two networks to operate across Pennsylvania and New Jersey and provide additional treatment options for patients. While it’s unclear the exact reasons the two systems decided to merge, it’s a common strategy to improve the financial health of an organization, so it’s possible but not definitively connected to the various financial challenges LVHN has faced.

 

What’s next

The settlement will start the clock on LVHN’s 3-year corrective action plan. Some of the steps they will be expected to take include:

  • Conducting an accurate and thorough risk assessment to determine the potential risks and vulnerabilities of their systems,
  • Developing and implementing a risk management plan that addresses any risks or vulnerabilities,
  • Reviewing and revising (if needed) their current breach notification policies to comply with HIPAA, and
  • Reviewing and revising training materials for employees to ensure HIPAA compliance

As LVHN improves its cybersecurity system, it still continues to thrive through decisions like merging with Jefferson Health, showing that even in the face of extreme financial pressure, many health organizations find ways to make the best out of challenging circumstances.

 

FAQs

What happens if LVHN fails to implement their corrective action plan?

The HHS will regularly monitor the implementation of the corrective action plan and will work with LVHN to ensure they are able to meet all benchmarks. If LVHN is struggling, the HHS will be able to provide additional assistance.

 

Is it possible for LVHN to face any other repercussions for this incident?

While it is possible LVHN could face another lawsuit or additional penalties, it’s highly unlikely. New evidence would have to be discovered and it would have to be sufficient enough to warrant another case. Most likely, this will be the final repercussion for this particular incident.