A Pennsylvania health system has become the latest teaching case for what federal regulators expect from hospitals that get hit by ransomware. The HHS Office for Civil Rights closed its investigation of Lehigh Valley Health Network with a $800,000 financial penalty and a corrective action plan, marking OCR’s 22nd ransomware probe to end in a payment.
The intrusion itself is older than the paperwork suggests. Staff spotted suspicious activity on February 4, 2023, and the ALPHV/BlackCat crew was confirmed as the intruder, working through IT systems tied to Delta Medix, a practice group the network had acquired two years earlier. Records for 248,359 people were lifted and leaked after no ransom was paid, including radiation oncology images in which patients were partly undressed.
OCR’s findings lean on process, not malware. The network failed to run a comprehensive and accurate risk analysis, and it had no real policy for reviewing audit logs, access reports and incident tracking records. Regulators also faulted late notices to patients and to the secretary, and said the gaps added up to an impermissible disclosure of electronic PHI.
The sequence is the one worth pasting into a board deck. Regulators dated the intrusion to February 4, 2026, and only received the breach report on May 15, 2026, roughly 100 days of clock. A separate class action already cost the network $65M.
For hospital security leaders the lesson is unglamorous. Logging without review, and a risk analysis stapled together after an incident, both became findings. Photographed patients raised the harm beyond data fields, which is why this file keeps resurfacing as a regulatory reference point.
