HHS Settles with Lehigh Valley Health Network for Ransomware Breach
Original title: HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network
The HHS Office for Civil Rights settled with Lehigh Valley Health Network for $800,000 and a corrective action plan after a 2023 ransomware attack that affected 248,359 individuals.
HHS OCR announced settlement with Lehigh Valley Health Network and its affiliates concerning HIPAA violations from a February 2023 ransomware attack. The attack exfiltrated protected health information of 248,359 individuals, including cancer patient photos, names, and lab results. LVHN agreed to a three-year corrective action plan and paid an $800,000 penalty.
Unconfirmed: The exact scope of data posted on the dark web is not detailed beyond the reported PHI categories.
- Affected 248,359 individuals
- Paid $800,000 penalty
- Three-year corrective action plan
- Violations included failure to conduct risk analysis
Impact: Exfiltration of protected health information
| Product | Affected |
|---|---|
| Lehigh Valley Health Network Healthcare systems | — |
- 1.Conduct accurate risk analysis
- 2.Review and revise Privacy Security policies
- 3.Encrypt ePHI in transit and at rest
- Threat actors
- AlphV (BlackCat)
- Victims
- Lehigh Valley Health Network
- Organizations
- HHS Office for Civil Rights
- Countries
- United States
From the original article
6 min read at databreaches.netDataBreaches. net previously covered the 2023 Lehigh Valley Health Network breach by AlphV (aka “BlackCat”). The breach garnered a lot of public attention when the threat actors crossed a line by posting nude pictures of patients on their leak site.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.