Every few months, the Office for Civil Rights (OCR) announces another settlement, and the same thought circulates in compliance offices: we do a risk analysis, we have a breach policy, we're fine. The Lehigh Valley Health Network case is worth a closer read because it shows how those assumptions fail in practice. The health system agreed to an $800,000 penalty and a corrective action plan after a ransomware attack exposed the Protected Health Information (PHI) of 248,359 individuals. OCR described it as its 22nd ransomware investigation to end in a financial penalty.
For regulatory affairs teams in life sciences, the details matter. Here are five myths the case puts to the test.
Myth 1: "We completed a risk analysis, so we've met the requirement."
Reality: The Security Rule doesn't just ask for a risk analysis. It requires an accurate and thorough one, covering risks and vulnerabilities to the confidentiality, integrity, and availability of all Electronic Protected Health Information (ePHI) your organization creates, receives, maintains, or transmits. OCR found Lehigh Valley Health Network failed to conduct a comprehensive and accurate analysis, and the corrective action plan now requires one.
A comprehensive analysis, consistent with NIST SP 800-66, generally includes:
- A complete inventory of systems and data flows that touch ePHI, including legacy and acquired systems
- Identification of threats and vulnerabilities for each
- Assessment of current controls
- Likelihood and impact determinations
- Risk levels assigned and documented
- A follow-on risk management plan
A document that lists only the systems IT remembers to mention doesn't meet that bar.
Myth 2: "An acquired company's systems are the seller's problem until integration is done."
Reality: Once you own it, you're accountable for it. The ALPHV/BlackCat group breached IT systems tied to Delta Medix, a company Lehigh Valley Health Network acquired in 2021. The attack surfaced in early 2023. OCR still held the acquirer responsible for the enterprise-wide risk analysis.
Treat every acquisition, and every affiliate or subsidiary, as a trigger for a fresh risk analysis. Build ePHI discovery into due diligence. Put acquired environments on your own risk register on day one, even if network integration will take a year.
Myth 3: "Logging is an IT function, not a compliance obligation."
Reality: Information system activity review is a Required Specification under the HIPAA Security Rule. OCR found Lehigh Valley Health Network failed to implement procedures for regularly reviewing records of system activity, such as audit logs, access reports, and security incident tracking reports.
Collecting logs isn't enough. Someone has to review them on a defined schedule, with documented escalation paths. Your policy should state who reviews what, how often, and what counts as reportable. Evidence of the review matters as much as the review itself.
OCR Director Paula M. Stannard put it plainly: failing to conduct an accurate risk analysis and to regularly review system activity makes regulated entities attractive targets. Her statement also named the fix: full implementation of the Security Rule.
Myth 4: "The 60-day breach clock starts when we finish investigating."
Reality: Under the Breach Notification Rule, the clock starts at discovery, not at confirmation of scope. The intrusion was detected on February 4, yet OCR was notified on May 15. The Secretary of HHS must be notified of a breach of unsecured PHI within 60 days of discovery, and affected individuals face the same outer limit. OCR found Lehigh Valley Health Network missed timely notification for both.
The 60-day figure is an outer limit, not a target. Notification must go out without unreasonable delay. A practical approach:
- Define "discovery" in your incident response plan as the first moment anyone in the workforce knows, or reasonably should know, of a potential breach
- Start a documented breach risk assessment immediately
- Assign a named owner for HHS and individual notifications
- Don't wait for forensic closure before drafting notices
Breach notification failures show up repeatedly in OCR resolutions. According to recent reporting, five of the 12 HIPAA settlements announced this year included them, as did five last year. OCR hasn't announced a dedicated enforcement initiative, but the pattern is hard to ignore.
Myth 5: "If we refuse the ransom, the damage is contained."
Reality: Lehigh Valley Health Network didn't pay, and the stolen data was leaked on the group's dark web site anyway. The exposed data ranged from names, Social Security numbers, and financial information to diagnoses, lab results, and treatment information. It also included photographs of cancer patients receiving radiation oncology treatment. The health system later settled related class action litigation for $65 million, far beyond the OCR penalty.
Refusing to pay is often the right call, but it's an incident response decision, not a risk mitigation strategy. The real controls are upstream: minimizing what data is stored where, segmenting networks, restricting access, and detecting exfiltration early. The sensitivity of the leaked data should also push you to ask whether highly sensitive records, such as clinical images, sit in places that your risk analysis has actually examined.
What to do instead
Treat the corrective action plan as a free checklist. OCR required Lehigh Valley Health Network to do four things, and you can do them before anyone asks:
- Conduct an enterprise-wide risk analysis covering every ePHI repository, including acquired and legacy systems.
- Build a risk management plan with owners, deadlines, and tracked remediation, not just a findings list.
- Revise policies and procedures so activity review and breach notification have named owners and timelines.
- Train your workforce on the HIPAA Rules as they apply to each person's job duties.
OCR will monitor Lehigh Valley Health Network for three years. That's the real cost of a thin risk analysis: not just the penalty, but a long period of regulatory oversight. Update your analysis after any acquisition, system change, or significant incident, and keep the documentation that proves you did.
