HHS OCR settlement announced October 29, 2026; ransomware discovered February 4, 2023; breach reported May 15, 2023
OCR's 22nd Ransomware Settlement: Lehigh Valley Pays $800,000 for a Missing Risk Analysis, Unread Logs, and Late Notices
The HHS Office for Civil Rights announced on October 29 that Lehigh Valley Health Network, a Pennsylvania health system, will pay $800,000 and follow a three-year corrective action plan to settle potential violations of the HIPAA Privacy, Security, and Breach Notification Rules, in OCR's 22nd ransomware enforcement action. The underlying attack was discovered on February 4, 2023 and reported to OCR on May 15, 2023. Protected health information was exfiltrated and posted on the dark web, affecting 248,359 individuals and including sensitive photographs of cancer patients receiving radiation oncology treatment, names, addresses, dates of birth, Social Security numbers, driver's license numbers, financial information, diagnoses, lab results, medications and treatment information. OCR's findings are a short list of fundamentals: the network failed to conduct an accurate and thorough risk analysis of its electronic protected health information, failed to implement procedures to regularly review records of information system activity such as audit logs, access reports and security incident tracking reports, impermissibly disclosed the information, and failed to notify affected individuals and the Secretary on time. The corrective action plan requires a proper risk analysis, a risk management plan addressing what it finds, revised policies and procedures, and updated workforce training, all monitored by OCR for three years. OCR Director Paula M. Stannard put the agency's position in one sentence: failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks.
Executives
The penalty here is not really about the ransomware. It is about the three years of ordinary duties that were not done before it arrived: a real risk analysis, logs that someone actually reviews, and notification clocks that are met. A corrective action plan also means three years of federal monitoring, which costs more in management attention than the check. Boards of any HIPAA-regulated organization should ask for the date of the last risk analysis and evidence that its findings were acted on, because that is the first document OCR will request.
CIO / CISO
Work OCR's finding list as your own checklist, in its order: a current, accurate and thorough risk analysis covering all electronic protected health information; a risk management plan that closes what it finds; a working procedure, with named owners and cadence, for reviewing audit logs, access reports and incident tracking; and breach notification runbooks that respect the regulatory clocks. The settlement is also a reminder that detection without review is not a control: the logs existed as a category in the rule, and the failure was that nobody was required to read them on a schedule.
Engineers
Make the review real in tooling: centralized log collection for systems holding electronic protected health information, scheduled review queues with sign-off, alerts on bulk export and unusual access to imaging and records systems, and retention that survives an incident. Keep the evidence as you go, because in an OCR investigation the record of regular review is the deliverable, and reconstructing it afterward is not possible.
Everyone (non-IT)
If you were a Lehigh Valley patient in 2023, you should already have been notified; this settlement is the federal government closing its investigation, and it does not ask anything new of patients. The general lesson travels well: health records cannot be reissued like a password, which is why the rules require the organizations holding them to know their risks and watch their own systems before an attack, not after.