Lehigh Valley Health Network has paid $800,000 to settle a federal investigation into a 2023 ransomware attack in which hackers posted photos of cancer patients taken during radiation treatment on the dark web. The HHS Office for Civil Rights announced the settlement on Oct. 29, 2026. The health system also agreed to a corrective action plan and did not admit liability, Becker’s Hospital Review reported.The breach affected 248,359 people. Depending on the person, exposed information included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial information, diagnoses, lab results, medications, and treatment information. Stolen files also included photographs of patients receiving radiation oncology treatment.For patients, the settlement does not undo the harm. Medical images cannot be changed like a password, and some of the leaked photos showed patients unclothed during cancer care.The Attack and the PhotosThe Allentown, Pennsylvania, system discovered suspicious activity on its network in early February 2023 and later determined it was ransomware. The attack, carried out by the Russian ransomware group BlackCat (also known as ALPHV), centered on systems tied to Lehigh Valley Physician Group-Delta Medix, a physician practice in Scranton.“The attack was on the network supporting one physician practice located in Lackawanna County,” Brian Nester, the network’s president and CEO at the time, said in February 2023. He said BlackCat demanded a ransom but that the health system refused to pay. The group then began publishing stolen patient images and data on its dark web leak site.The ransom demand was more than $5 million, according to local news reports citing court filings, The Record reported. Refusing to pay did not stop the leak.More than 600 patients had personal medical photos posted online, according to the law firm that represented patients in a class action, Fierce Healthcare reported. Some of the first images the group posted showed breast cancer patients.Lehigh Valley Health Network became part of Philadelphia-based Jefferson Health after the two systems completed their merger in August 2024.Federal Findings and the Corrective PlanThe Office for Civil Rights (OCR) cited potential violations of the HIPAA Privacy, Security, and Breach Notification rules. Investigators said the system failed to conduct an accurate and thorough risk analysis, failed to regularly review activity on its information systems, impermissibly disclosed the health information of 248,359 people, and failed to notify affected patients and HHS on time. The health system filed its breach report with HHS on May 15, 2023, more than three months after discovering the attack.OCR Director Paula M. Stannard said that failing to conduct a thorough risk analysis and regularly review system activity “makes regulated entities attractive targets for cyberattacks.” She added, “The best defense against cyberattacks is full implementation of the HIPAA Security Rule.” HHS said the agreement is OCR’s 22nd ransomware enforcement action.Under a corrective action plan that OCR will monitor for three years, the system must conduct a thorough risk analysis of its electronic health information, develop and carry out a risk management plan, review and revise its HIPAA policies, and update workforce training, according to the HIPAA Journal.The federal penalty is small next to the earlier civil case. A Lackawanna County judge approved a $65 million class-action settlement on Nov. 15, 2024. Patients whose nude images were posted were eligible for the largest payments, expected to be $70,000 to $80,000 each.What Affected Patients Can DoThe people most affected are patients of the Delta Medix practice, especially those who received radiation oncology care and whose images were published. Anyone whose Social Security number or financial information was taken also faces a longer-term risk of identity theft and medical identity fraud.The federal settlement creates no new claims process for patients, and the deadlines for the class-action settlement passed in 2024. Patients who are unsure whether they were affected can contact the health system or review the cyber incident notice Lehigh Valley posted.Practical protections still help. Patients can freeze their credit with the three major credit bureaus at no cost, review insurance explanation-of-benefits statements for services they never received, and request an accounting of disclosures from their providers. Patients who believe a provider mishandled their records can file a complaint with the HHS Office for Civil Rights.Medical identity theft can be harder to spot than credit fraud. Warning signs include bills for care you never received, collection notices from unfamiliar providers, or a health plan saying you have reached a benefit limit. Patients who see these signs should contact their insurer and the provider listed on the bill.Ransomware Risks Beyond PennsylvaniaHealth care remains a major target for ransomware. BlackCat was also behind the February 2024 Change Healthcare attack, which disrupted pharmacy and billing systems nationwide.Federal penalties in these cases have stayed relatively small. OCR’s first ransomware settlement, announced in October 2023, was a $100,000 agreement with Doctors’ Management Services. In July 2024, Pennsylvania’s Heritage Valley Health System agreed to pay $950,000. Lehigh Valley’s $800,000 falls in the same range, far below the $65 million paid to patients through the courts.As of early June, at least 20 health care organizations had reported breaches affecting 100,000 or more people to federal regulators in 2026, according to Becker’s tally of the HHS breach portal.Patients can also ask their providers how clinical photos are stored, who can access them, and how long they are kept. The settlement closes the federal investigation, but OCR will monitor the health system’s corrective action plan for the next three years.
Key Questions AnsweredWhat happened at Lehigh Valley Health Network? In February 2023, the BlackCat ransomware group stole patient data, including photos of radiation oncology patients, and posted it online after the health system refused to pay a ransom.How much is the federal settlement? Lehigh Valley Health Network paid $800,000 and agreed to a corrective action plan that OCR will monitor for three years.How many people were affected? The breach affected 248,359 people, according to the HHS Office for Civil Rights.Did the health system admit wrongdoing? No. The settlement includes no admission of liability.Can patients get money from this settlement? No. The federal payment goes to the government. A separate $65 million class-action settlement for patients received final court approval in November 2024.How can affected patients protect themselves? They can freeze their credit, review insurance statements for unfamiliar charges, and request an accounting of disclosures from their providers.Where can patients report privacy violations? They can file a complaint with the HHS Office for Civil Rights.
Published by Medicaldaily.com
Join the Discussion
——————————————————–
Click Here For The Original Source.
