The US Department of Health and Human Services' Office for Civil Rights (OCR) has settled with Lehigh Valley Health Network for US$800,000 plus a corrective action plan over violations tied to the ALPHV/BlackCat ransomware breach of its Delta Medix systems — OCR's 22nd ransomware-related HIPAA financial penalty. The 2023 incident exposed the protected health information of 248,359 individuals; stolen data, including photographs of radiation-oncology cancer patients, was leaked on the group's dark-web site after the ransom went unpaid. OCR found the Pennsylvania health system failed to conduct a comprehensive and accurate risk analysis, failed to review information-system activity and audit logs, and breached the Breach Notification Rule by not notifying affected individuals and the HHS Secretary in a timely manner. OCR Director Paula Stannard said the case underscores that accurate risk analysis and activity review "makes regulated entities attractive targets" in their absence. The network also settled its class action over the breach for US$65 million.

• Source article