What Happened
The Office for Civil Rights (OCR) recently announced an $800,000 settlement with Lehigh Valley Health Network (LVHN) over potential HIPAA violations discovered during an investigation into a 2023 ransomware attack. This attack affected over 248,000 individuals, with the BlackCat ransomware group, also known as AlphV, posting stolen examination photographs of breast cancer patients online.
The settlement includes a corrective action plan with three years of federal monitoring, requiring LVHN to enhance its information security risk analysis, risk management, and other HIPAA compliance practices. This marks the 22nd ransomware-related enforcement action against a HIPAA-regulated organization.
The regulatory settlement isn't the end of LVHN's exposure. In 2024, LVHN agreed to pay $65 million to settle civil class action litigation from the same incident.
Two other health systems are facing similar challenges. University Hospitals in Ohio is restoring IT systems after an October 22 incident, and the University of New Mexico Health Sciences Center had to divert ambulances and suspend surgeries following an attack. Neither has confirmed ransomware involvement or patient data theft, but these incidents illustrate the early stages of what LVHN has experienced.
Timeline
- 2023: Ransomware attack on LVHN affects over 248,000 people; BlackCat/AlphV leaks patient photos.
- 2024: LVHN agrees to a $65 million settlement for class action litigation.
- Oct. 22: University Hospitals reports a cybersecurity incident, affecting its MyChart portal and causing appointment disruptions.
- Same week: UNM Health Sciences Center experiences a cyberattack, leading to ambulance diversions and surgery suspensions. Services resume by Wednesday.
- Thursday: OCR announces the LVHN settlement.
- Friday: Federal class action proposed against University Hospitals; law firm investigates UNM incident.
The pattern is clear: operational disruption occurs quickly, litigation follows, and regulatory resolution takes years.
Which Controls Failed or Were Missing
OCR's announcement highlights the corrective action plan's focus on information security risk analysis and risk management. This indicates where OCR found deficiencies. A ransomware event often reveals broader compliance failures, such as inadequate identification and protection of ePHI.
For the New Mexico and Ohio incidents, specific control failures haven't been confirmed. Public records only show impacts like ambulance diversions and offline portals. Avoid making assumptions about root causes based on these symptoms.
What the Relevant Standard Requires
The HIPAA Security Rule outlines obligations OCR evaluates in ransomware cases:
- Risk analysis, 45 CFR 164.308(a)(1)(ii)(A): Conduct a thorough assessment of risks to ePHI confidentiality, integrity, and availability. This includes all systems handling ePHI, not just EHRs.
- Risk management, 45 CFR 164.308(a)(1)(ii)(B): Implement security measures to mitigate identified risks. A risk analysis without follow-through fails this requirement.
- Contingency plan, 45 CFR 164.308(a)(7): Requires data backup, disaster recovery, and emergency mode operation plans. Testing and revision procedures are also crucial.
- Information system activity review, 45 CFR 164.308(a)(1)(ii)(D): Regularly review audit logs and security incident tracking.
- Breach Notification Rule, 45 CFR 164.400-414: Governs notification to individuals, OCR, and sometimes the media after a breach of unsecured PHI.
NIST SP 800-66 provides practical steps for implementing these standards. HITRUST CSF offers a certifiable control set with Control Maturity Scoring for deeper implementation evidence.
Lessons and Action Items for Your Team
Audit your risk analysis. Ensure it inventories every system handling ePHI, including imaging archives and patient portals. If your inventory can't map system connections, it's incomplete.
Link risks to remediation actions. Your risk register should detail risks, decisions, owners, and completion dates. Unaddressed risks are liabilities.
Test your contingency plan with clinical input. Run exercises simulating EHR and workflow outages. Document and fix what breaks.
Classify and protect high-sensitivity data. Identify where sensitive records are stored and who can access them. Ensure segmentation and access controls are appropriate.
Prepare for follow-on scams. Develop patient communication templates to quickly warn about fraud after an incident.
Plan for legal challenges. Engage legal and forensic experts under an incident response retainer. Maintain documentation from day one.
Document Recognized Security Practices. Keep records of NIST SP 800-66 or HITRUST CSF implementations. This documentation is crucial if OCR investigates.
The LVHN case shows the importance of proactive cybersecurity and compliance. Ensure your program demonstrates risk analysis and management efforts that predate any incident.
