HHS Settles with Lehigh Valley Health Network Over Ransomware Breach
Original title: HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network
HHS Office for Civil Rights settled with Lehigh Valley Health Network for $800,000 and a three-year corrective action plan following a 2023 ransomware attack that exposed PHI of 248,359 individuals.
The HHS Office for Civil Rights announced a settlement with Lehigh Valley Health Network and affiliates. The network paid an $800,000 penalty and agreed to a three-year corrective action plan to address HIPAA violations. The settlement stems from a February 2023 ransomware attack by AlphV (BlackCat) that exfiltrated protected health information including cancer patient photos and personal data. The breach affected 248,359 individuals. OCR found failures in risk analysis, audit logs, and timely breach notifications.
- 248,359 individuals had PHI exposed including cancer treatment photos.
- Attack by AlphV (BlackCat) ransomware group.
- Lehigh Valley Health Network paid $800,000 penalty.
- Three-year corrective action plan required.
- OCR found violations in risk analysis and breach notification rules.
| Product | Affected |
|---|---|
| Lehigh Valley Health Network | — |
- Victims
- 248359 individuals
- Countries
- United States
From the original article
6 min read at databreaches.netDataBreaches. net previously covered the 2023 Lehigh Valley Health Network breach by AlphV (aka “BlackCat”). The breach garnered a lot of public attention when the threat actors crossed a line by posting nude pictures of patients on their leak site.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.