HHS settles ransomware investigation with Lehigh Valley Health Network

The U.S. Department of Health and Human Services, Office for Civil Rights (OCR), has settled a ransomware investigation with Lehigh Valley Health Network (LVHN) and its affiliated entities, the agency announced on 29 October 2026. The settlement imposes an $800,000 monetary penalty and a three-year corrective action plan (CAP) to bring LVHN into compliance with the HIPAA Privacy, Security, and Breach Notification Rules. OCR notes this is OCR’s 22nd ransomware enforcement action.

The investigation centred on a February 2023 ransomware incident in LVHN’s IT environment, first reported on 4 February 2023 and publicly disclosed after LVHN found suspicious activity on 15 May 2023.

OCR found multiple potential violations, including failure to conduct an accurate risk analysis of ePHI risks, inadequate review of information system activity (such as audit logs and security incident tracking), impermissible disclosure of PHI for 248,359 individuals, and delays in notifying affected individuals and the HHS Secretary about the breach. The exfiltration and posting of PHI to the dark web are highlighted as the incident’s consequences.

Under the settlement, LVHN will implement measures to comply with HIPAA rules, including completing a thorough risk analysis, developing a risk management plan, revising applicable policies and procedures, and updating HIPAA training for staff. OCR will monitor LVHN’s progress for three years under the CAP.