Lehigh Valley pays $800,000 after ransomware patient breach
A 2023 breach, settled in 2026
The US Department of Health and Human Services has settled with Lehigh Valley Health Network for $800,000 over a ransomware incident that exposed the protected health information of 248,359 people. The settlement, announced by the department's Office for Civil Rights on 29 October 2026, also puts the Pennsylvania health system under a three-year corrective action plan.
The health system discovered suspicious activity on 4 February 2023, later determined to be ransomware, and filed its breach report on 15 May 2023. Investigators linked the intrusion to the ALPHV/BlackCat group, which reached IT systems connected to Delta Medix, a company the health system had acquired in 2021.
Stolen material included names, addresses, dates of birth, Social Security numbers, financial details, diagnoses, laboratory results and medication information, according to reporting on the case. HIPAA Journal also reported that related class-action litigation was settled for $65 million.
What the regulator found wrong
The regulator said the health system had failed to carry out a thorough and accurate assessment of risks to electronic health information, and had failed to review system activity records such as audit logs regularly. It also found that affected people and the department itself were not notified in time.
The corrective plan now requires a comprehensive risk analysis, a risk management plan, revised privacy, security and breach-notification policies, and workforce training, monitored for three years. The regulator described the case as its 22nd ransomware enforcement action. For other health providers, the message is plain: a risk assessment that is never refreshed, and logs that are never reviewed, can turn an old intrusion into a present-day penalty.
