On October 29, the HHS Office for Civil Rights (OCR) announced that Lehigh Valley Health Network (LVHN) paid $800,000 and agreed to three years of OCR monitoring to settle a ransomware investigation. HHS called it OCR's 22nd ransomware enforcement action.

The announcement came eight days after HHS confirmed, in an October 21 Federal Register notice, that HIPAA penalty amounts would stay at their 2025 levels. As Paubox covered last week, the HIPAA penalty freeze doesn't lower your risk. LVHN's settlement shows why: its corrective action plan runs under three years of OCR monitoring, a year longer than the two years attached to each of the April and September settlements in that post.

Ransomware came in through an acquired physician group and affected 248,359 people

LVHN is a Pennsylvania health system with five acute care hospitals, a large physician group, ambulance services, a retail pharmacy, and hospice and home care services, according to the resolution agreement.

Attackers deployed ransomware in the IT system of a physician group LVHN had acquired, then stole patient data and posted it on the dark web. HHS says the attack affected the protected health information (PHI) of 248,359 people.

The stolen data included names, addresses, dates of birth, Social Security numbers, financial information, diagnoses, lab results, medications, and treatment information. It also included sensitive photographs of cancer patients receiving radiation oncology treatment.

The agreement resolves potential violations. It states that it isn't an admission of liability by LVHN.

OCR found five potential violations, starting with the risk analysis

OCR's findings cover the HIPAA Security, Privacy, and Breach Notification Rules. According to HHS, LVHN potentially:

  • Failed to conduct an accurate and thorough risk analysis of the risks and vulnerabilities to all of its electronic protected health information (ePHI).
  • Failed to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.
  • Impermissibly disclosed the PHI of 248,359 individuals.
  • Failed to notify affected individuals in time.
  • Failed to notify the HHS Secretary in time.

OCR Director Paula M. Stannard tied the first two findings to cyberattack risk: "Failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks."

The same risk analysis failure appeared in every settlement Paubox covered in the penalty-freeze post, from the four ransomware cases OCR closed in April to the Ambry Genetics phishing case in September.

The corrective action plan adds three years of OCR oversight

Beyond the $800,000, LVHN committed under the corrective action plan to:

  • Conduct an accurate and thorough risk analysis of its ePHI
  • Develop and carry out a risk management plan for the risks that analysis finds
  • Review and revise its Privacy, Security, and Breach Notification Rule policies and procedures
  • Develop or revise HIPAA training for all workforce members, matched to their job duties

OCR will monitor that work for three years.

Breach notification timing drew its own findings

Two of OCR's five findings concern breach notification: LVHN failed to notify affected individuals and the HHS Secretary in time, according to HHS.

The HIPAA Breach Notification Rule sets two deadlines, according to HHS. Affected individuals must be notified without unreasonable delay and no later than 60 days after the breach is discovered. When a breach affects 500 or more people, as LVHN's did, the HHS Secretary must be notified on the same timeline. Smaller breaches can be reported to the Secretary once a year, within 60 days after the end of the calendar year.

Late notice is a common finding. HIPAA Journal counts breach notification failures in five of the 12 HIPAA settlements announced this year.

For a compliance team, that makes the notification timeline part of the incident response plan, with a named owner and a deadline, before an incident starts.

OCR's recommendations start with knowing where ePHI goes

HHS closed the LVHN announcement with steps OCR recommends to prevent cyber threats. Several map directly to the findings above:

  • Identify where ePHI lives in the organization, including how it enters, moves through, and leaves your systems. Email is one of the paths ePHI takes out of the organization, so the risk analysis has to cover it.
  • Conduct a risk analysis periodically, update it as needed, and act on it with a risk management plan.
  • Put audit controls in place, and review information system activity on a schedule. Paubox's guide to how healthcare organizations use audit logs for HIPAA compliance walks through building that program.
  • Encrypt ePHI in transit and at rest when appropriate. For email, that means encrypting messages in transit with HIPAA compliant email.
  • Give workforce members regular HIPAA training specific to their job duties.

The penalty amounts will catch up in 2027, when HIPAA Journal expects the inflation adjustment to cover two years at once. A current risk analysis and a record of audit log reviews are what an OCR investigator asks for either way.