OCR settles with Pennsylvania health system Lehigh Valley Health Network for $800,000 after ransomware

What happened

On October 29, 2026, the HHS Office for Civil Rights announced a settlement with Lehigh Valley Health Network, a Pennsylvania based health system, and its affiliated covered entities. The release says the network found suspicious activity in its IT systems in early February 2023, later determined to be ransomware, and that patient health information was stolen and posted on the dark web. It reports that 248,359 individuals were affected and that the network filed a breach report in May 2023.

OCR said the network potentially violated the HIPAA Privacy, Security and Breach Notification Rules. The findings it cited were an inadequate risk analysis, insufficient review of system activity records, impermissible disclosure of the affected information, and untimely notice to both affected individuals and HHS.

The network paid $800,000 to OCR and agreed to a corrective action plan that OCR will monitor for three years. The release labels the matter OCR’s 22nd ransomware enforcement action. It describes the findings as potential violations and does not state whether the network admitted liability, and we are not characterizing it either way.

Analysis: The risk analysis shows up again, but two of these findings are about habits rather than documents. Reviewing system activity means someone actually looks at the logs and access records the clinic’s systems produce, and notice timing means a clinic that finds an incident acts on a clock. Both are within reach of a small ABA clinic. A useful test is to ask who looks at the activity reports from the records and billing systems, how often, and where the review is written down, and to ask whether the clinic has a written incident response step that starts the notice clock the day an incident is found. The network here is far larger than any clinic, but the duties named are the same ones. This is reporting, not legal advice.