Lehigh Valley Health Network pays $800K HIPAA penalty over 2023 ALPHV/BlackCat ransomware breach
Lehigh Valley Health Network (LVHN) agreed to pay an $800,000 penalty and adopt a corrective action plan to settle HIPAA violations with the HHS Office for Civil Rights (OCR) following a ransomware attack that exposed the PHI of 248,359 individuals. The ALPHV/BlackCat group breached IT systems tied to Delta Medix, a practice LVHN acquired in 2021, exfiltrated patient files and demanded ransom; LVHN refused to pay and the data was leaked on the group's dark web site. Leaked data included Social Security numbers, driver's license numbers, financial data, diagnoses, lab results, and clinical photographs of radiation oncology patients, some partially naked. LVHN previously settled related class action litigation for $65 million. This is OCR's 22nd financial penalty stemming from a ransomware investigation.
Detalhes técnicos
OCR found LVHN failed to conduct a comprehensive and accurate risk analysis of risks to ePHI and failed to implement policies for regular review of information system activity (audit logs, access reports, security incident tracking). These Security Rule failures led to impermissible disclosure under the Privacy Rule. OCR also cited Breach Notification Rule failures: the intrusion was detected 4 February and OCR was notified only on 15 May, beyond the 60-day requirement.
Remediação
The corrective action plan requires a full risk analysis, a risk management plan, revised HIPAA policies and procedures, and workforce training, with three years of OCR monitoring.
Linha do tempo
-
Lehigh Valley Health Network pays $800K HIPAA penalty over 2023 ALPHV/BlackCat ransomware breach
ler a análise desta fonte ocultar
Lehigh Valley Health Network (LVHN) agreed to pay an $800,000 penalty and adopt a corrective action plan to settle HIPAA violations with the HHS Office for Civil Rights (OCR) following a ransomware attack that exposed the PHI of 248,359 individuals. The ALPHV/BlackCat group breached IT systems tied to Delta Medix, a practice LVHN acquired in 2021, exfiltrated patient files and demanded ransom; LVHN refused to pay and the data was leaked on the group's dark web site. Leaked data included Social Security numbers, driver's license numbers, financial data, diagnoses, lab results, and clinical photographs of radiation oncology patients, some partially naked. LVHN previously settled related class action litigation for $65 million. This is OCR's 22nd financial penalty stemming from a ransomware investigation.
Technical Details
OCR found LVHN failed to conduct a comprehensive and accurate risk analysis of risks to ePHI and failed to implement policies for regular review of information system activity (audit logs, access reports, security incident tracking). These Security Rule failures led to impermissible disclosure under the Privacy Rule. OCR also cited Breach Notification Rule failures: the intrusion was detected 4 February and OCR was notified only on 15 May, beyond the 60-day requirement.
Remediation
The corrective action plan requires a full risk analysis, a risk management plan, revised HIPAA policies and procedures, and workforce training, with three years of OCR monitoring.