Lehigh Valley Health Network Pays $800K Penalty to Resolve HIPAA Violations
Lehigh Valley Health Network has agreed to settle alleged violations of the HIPAA Rules with the HHS’ Office for Civil Rights (OCR) and will pay an $800,000 financial penalty and adopt a corrective action plan to address identified areas of noncompliance. This is OCR’s 22nd investigation of a ransomware attack to result in a financial penalty for noncompliance with the HIPAA Rules.
OCR launched an investigation after receiving a breach report on May 15, 2026, from Lehigh Valley Health Network about a cybersecurity incident that exposed the protected health information (PHI) of 248,359 individuals. Lehigh Valley Health Network identified suspicious activity within its network in early February 2023 and later confirmed that ransomware was involved. The ALPHV/BlackCat ransomware group breached parts of its network, specifically IT systems related to Delta Medix, a company acquired by Lehigh Valley Health Network in 2021. The ransomware group exfiltrated files containing patient information and issued a ransom demand. The ransom was not paid, and the stolen data was leaked on the ransomware group’s dark web data leak site.
Data stolen and leaked in the incident included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, and treatment information. In addition, photographs of cancer patients receiving radiation oncology treatment were stolen in the incident and leaked online, including photographs of patients who were naked from the waist up. Lehigh Valley Health Network was sued over the data breach and settled the class action litigation for $65 million.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
OCR’s investigation identified multiple potential violations of the HIPAA Rules, including two violations of the HIPAA Security Rule. Lehigh Valley Health Network was determined to have failed to conduct a comprehensive and accurate risk analysis to identify risks and vulnerabilities to electronic PHI, and failed to implement policies and procedures for regularly reviewing records of activity in information systems containing ePHI, such as audit logs, access reports, and security incident tracking reports. These failures led to the impermissible disclosure of the ePHI of 248,359 individuals, in violation of the HIPAA Privacy Rule.
OCR also determined that Lehigh Valley Health Network failed to issue timely notifications to the affected individuals to alert them to the theft of their personal and health information and did not issue a timely notification to the Secretary of the Department of Health and Human Services, in violation of the HIPAA Breach Notification Rule. According to OCR, the intrusion was detected on February 4, 2026, and OCR was notified about the incident on May 15, 2026. The HHS Secretary must be notified about a breach of unsecured protected health information within 60 days of discovery of a breach. While OCR has not stated that it has an active enforcement initiative targeting noncompliance with the HIPAA Breach Notification Rule, a significant number of recent settlements have involved penalties for breach notification failures, including five of the 12 HIPAA settlements announced this year and five settlements last year.
Under the terms of the settlement agreement, in addition to the financial penalty, Lehigh Valley Health Network has agreed to adopt a corrective action plan that includes the requirements to conduct a comprehensive and accurate risk analysis, develop a risk management plan, review and revise its policies and procedures to ensure compliance with the HIPAA Rules, and develop training materials and provide training to its workforce on the HIPAA Rules relative to the performance of individuals’ job duties. OCR will monitor Lehigh Valley Health Network for compliance for a period of three years.
“Failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks,” said OCR Director Paula M. Stannard. “The best defense against cyberattacks is full implementation of the HIPAA Security Rule.”
