Allentown, Pa.-based Lehigh Valley Health Network paid $800,000 to settle a federal investigation into a 2023 ransomware attack that exposed the protected health information of nearly 250,000 individuals, including sensitive photographs of cancer patients.
The HHS Office for Civil Rights announced the settlement in an Oct. 29 news release, citing potential violations of the HIPAA Privacy, Security and Breach Notification rules. The agreement also requires the health system to implement a corrective action plan that federal regulators will monitor for three years.
The investigation stemmed from a February 2023 ransomware attack in which hackers accessed patient information and posted it on the dark web. The breach affected 248,359 individuals and exposed information including names, addresses, Social Security numbers, financial information, diagnoses, medications, treatment records and photographs of patients undergoing radiation oncology treatment.
OCR identified several potential HIPAA violations, including failures to conduct a comprehensive security risk analysis, regularly review information system activity and provide timely breach notifications to affected patients and HHS.
As part of the corrective action plan, Lehigh Valley Health Network must conduct a thorough assessment of risks to electronic protected health information, develop a risk management plan, review its HIPAA policies and procedures, and update workforce training materials as necessary.
“Failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks,” OCR Director Paula M. Stannard said in the release.
The agreement marks OCR’s 22nd ransomware enforcement action, according to HHS.
Under the resolution agreement, Lehigh Valley Health Network did not admit liability.
The ransomware attack previously resulted in a separate $65 million class-action settlement, which a Pennsylvania judge approved in November 2024. The lawsuit followed the publication of sensitive patient photographs by the BlackCat ransomware group after Lehigh Valley refused to pay the hackers’ ransom demand.
Lehigh Valley Health Network became part of Philadelphia-based Jefferson Health following the organizations’ merger in August 2024.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
