HHS settles HIPAA ransomware investigation with Lehigh Valley

The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has announced a settlement with Lehigh Valley Health Network (LVHN) and its affiliated entities over potential HIPAA Privacy, Security and Breach Notification Rule violations tied to a ransomware incident first reported in May 2023.

OCR’s investigation followed LVHN’s breach report of 15 May 2023, revealing that a February 4, 2023 ransomware attack led to the exfiltration and posting on the dark web of protected health information (PHI) belonging to a large number of patients.

The data affected included 248,359 individuals and encompassed sensitive cancer-treatment photographs, as well as names, addresses, dates of birth, Social Security numbers, driver’s licence numbers, financial information, diagnoses, lab results, medications and treatment details. The OCR notes the case marks its 22nd ransomware enforcement action and requires LVHN to implement a three-year corrective action plan, accompanied by an $800,000 monetary penalty.

OCR accuses LVHN of several HIPAA shortcomings, including failing to conduct an accurate risk analysis for ePHI, failing to maintain regular review of information system activity (such as audit logs and security incident reports), and impermissibly disclosing PHI while failing to timely notify affected individuals and OCR itself of the breach.

The settlement requires LVHN to undertake a formal risk analysis, develop and execute a risk management plan, update privacy, security and breach-notification procedures, and revise training materials for staff. OCR Director Paula M.

Stannard emphasised that “the best defence against cyberattacks is full implementation of the HIPAA Security Rule.” The resolution document, including the CAP, is available in PDF form, and OCR recommends entities identify PHI locations, perform ongoing risk analyses, ensure audit controls, encrypt PHI in transit and at rest where appropriate, and provide tailored workforce training.