Introduction
The Office for Civil Rights (OCR) announced an $800,000 settlement with Lehigh Valley Health Network (LVHN) and its affiliated Covered Entities. This was OCR's 22nd ransomware enforcement action. LVHN also agreed to a three-year corrective action plan. The breach involved 248,359 individuals and was linked to the ransomware group ALPHV (BlackCat).
OCR's findings highlighted several compliance failures: LVHN did not conduct a thorough risk analysis, failed to review information system activity regularly, impermissibly disclosed Protected Health Information (PHI), and did not notify affected individuals or HHS promptly.
This checklist translates those findings into ten actionable checks for your team. It's designed for healthcare IT professionals responsible for implementing technical safeguards.
Prerequisites
Before you begin, gather:
- Your most recent enterprise-wide risk analysis and any risk management plan
- A current inventory of systems handling Electronic Protected Health Information (ePHI)
- Your incident response plan and breach notification policy
- Access to audit logs and security monitoring tools
- A named HIPAA Compliance Officer and Privacy Official for sign-off
If you can't produce an ePHI system inventory, start there. The following steps depend on it.
Checklist Items
1. Your risk analysis covers every system that touches ePHI.
Reference: HIPAA Security Rule, 45 CFR 164.308(a)(1)(ii)(A). OCR found LVHN's analysis lacked accuracy and thoroughness. Ensure your analysis includes cloud services, medical devices, imaging systems, and Business Associate connections, not just the core EHR.
What good looks like: Every ePHI system in your inventory is included in the analysis with identified threats, vulnerabilities, likelihood, and impact. NIST SP 800-66 provides a method.
2. Ransomware is scored as a named threat scenario.
Generic "malware" entries don't drive decisions. Include ransomware specifically, covering encryption of clinical systems, data exfiltration, and backup loss.
What good looks like: Each scenario links to a specific control, such as segmentation or offline backups, with documented residual risk.
3. The risk analysis is current and refreshed after major changes.
Ensure a dated analysis exists and is updated after significant events like new systems or mergers.
What good looks like: Your analysis history shows regular updates and event-driven changes, each with an approver's name.
4. A risk management plan exists and is being executed.
Reference: 45 CFR 164.308(a)(1)(ii)(B). A risk analysis alone doesn't reduce risk. LVHN's corrective action plan highlights the need for an active risk management plan.
What good looks like: Every identified risk has an owner, a remediation decision, a target date, and a status.
5. Information system activity is reviewed on a schedule.
Reference: 45 CFR 164.308(a)(1)(ii)(D). OCR cited LVHN for not regularly reviewing system activity records.
What good looks like: You can show a review calendar, alert records, and escalation tickets. Suspicious activity is investigated.
6. Detection-to-decision time is defined and tested.
LVHN's breach notice states suspicious activity was discovered on February 4th, 2023. Your incident response plan should define who declares an incident and assesses ePHI impact.
What good looks like: A tabletop exercise has been conducted with a ransomware scenario, and results are integrated into the plan.
7. Your breach notification procedure maps to the Breach Notification Rule deadlines.
Reference: 45 CFR 164.404, 164.408, 164.410. Individual notice is due without unreasonable delay and no later than 60 days after discovery.
What good looks like: A responsible person can follow a procedure from "incident confirmed" to "notices issued," with legal and Privacy Official review.
8. Your breach risk assessment is documented every time.
Reference: 45 CFR 164.402. Document every security incident that might involve PHI with a written determination.
What good looks like: Each incident file shows the four factors, the conclusion, and the sign-off.
9. Workforce training reflects real incident scenarios.
Reference: 45 CFR 164.308(a)(5), 164.530(b). LVHN's corrective action plan includes revising training materials.
What good looks like: Staff know how to report a suspected incident, and completion records are retained.
10. Business Associate and vendor risk is in the analysis.
Ensure every Business Associate with ePHI access has a current agreement and appears in your risk analysis.
What good looks like: You can name which vendors would halt operations if they went down, and your plan covers that outcome.
Common Mistakes
- Treating the risk analysis as a one-time project. Regular updates are essential.
- Confusing a vulnerability scan with a risk analysis. Scans are inputs; the analysis assesses threats and impacts.
- Logging without reviewing. Audit logs need regular review.
- Starting the breach clock late. Begin the notification timeline at discovery.
- Leaving leadership out. Highlight the cost of incidents to secure security investment.
Next Steps
- Score yourself 0 to 10 using the criteria above.
- Rank the gaps by ransomware impact. Items 1, 4, 5, and 7 were named by OCR in this case.
- Present the scorecard to your HIPAA Compliance Officer and executive sponsor with an owner and date for each gap.
- Schedule a ransomware tabletop exercise testing detection, breach assessment, and notification.
- Plan your next risk analysis refresh, tying it to change events.
A corrective action plan is what remediation looks like when OCR sets the terms. Implement your own plan proactively.
