Skip to content
RuleResource Intelligence

← All developments

HHS OCR Enforcement: Resolution Agreements & CMPs · October 29, 2026 · Primary source

HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network,

Score 96PRIMARYregulatoryHHS OCRHIPAA

Summary

HHS Office for Civil Rights entered a Resolution Agreement and Corrective Action Plan with Lehigh Valley Health Network (LVHN), a Pennsylvania-based non-profit integrated health system, resolving OCR Transaction No. 23-529270 arising from a February 2023 ransomware attack that exfiltrated and publicly posted the PHI of 248,359 individuals. OCR found LVHN violated the HIPAA Security Rule by failing to conduct an accurate risk analysis (45 C.F.R. 164.308(a)(1)(ii)(A)) and failing to review information system activity records, violated the Privacy Rule through impermissible PHI disclosure (45 C.F.R. 164.502(a)), and violated the Breach Notification Rule by failing to timely notify affected individuals (45 C.F.R. 164.404(b)) and the Secretary (45 C.F.R. 164.408(b)). LVHN, now a subsidiary of Jefferson Health following a 2024 merger, agreed to pay $800,000 and implement a CAP.

What this may mean

LVHN is required to pay $800,000 to HHS and comply with a Corrective Action Plan addressing risk analysis, information system activity review, and breach notification procedures across its affiliated covered entity, which encompasses five acute care hospitals, a large physician group, pharmacy, home care, hospice, and ambulance services. The resolution identifies ransomware-related failures in risk analysis and audit log review as the primary HIPAA Security Rule deficiencies driving the enforcement action. The $800,000 settlement and accompanying CAP obligations are binding on LVHN's successors, including Jefferson Health.

Informational only. Not legal, medical, financial, or other professional advice. Always consult a qualified professional familiar with your specific facts before relying on any item.

Related items