Lehigh Valley Health Network $800K
HHS’s Office for Civil Rights announced an $800,000 settlement with Lehigh Valley Health Network and affiliated entities. The settlement addresses potential violations of HIPAA’s Privacy, Security, and Breach Notification Rules. Lehigh Valley Health Network (LVHN) also agreed to implement a corrective action plan under three years of OCR monitoring.
Ransomware Exposed Sensitive Patient Information
The Pennsylvania health system discovered suspicious activity within its information systems on February 4, 2023. LVHN later determined that ransomware caused the incident and submitted a breach report on May 15, 2023. Attackers stole protected health information (PHI) and posted it on the dark web. The attack affected 248,359 individuals and exposed sensitive photographs of cancer patients receiving radiation oncology treatment.
The stolen information also included:
- Names, addresses, and birth dates.
- Social Security and driver’s license numbers.
- Financial information.
- Diagnoses, conditions, laboratory results, medications, and treatment information.
Potential Violations
The investigation identified potential violations involving risk analysis, activity reviews, unauthorized disclosures, and breach notifications.
OCR found that LVHN potentially failed to:
- Thoroughly assess risks and vulnerabilities affecting the confidentiality, integrity, and availability of all electronic protected health information (ePHI).
- Implement procedures for regularly reviewing audit logs, access reports, and security incident tracking reports.
- Protect 248,359 individuals’ PHI from impermissible disclosure.
- Notify affected individuals within required timeframes.
- Notify the HHS Secretary within required timeframes.
Corrective Action Requires Documented Improvements
OCR will monitor LVHN’s corrective action plan for three years. LVHN must take these steps:
- Conduct a thorough risk analysis covering risks and vulnerabilities to its ePHI’s confidentiality, integrity, and availability.
- Develop and implement a risk management plan addressing identified security risks and vulnerabilities.
- Review and revise Privacy, Security, and Breach Notification policies and procedures as necessary.
- Review, develop, or revise HIPAA training materials to address workforce members’ job responsibilities.
Practical Steps to Reduce Cybersecurity Risks
OCR Director Paula M. Stannard emphasized that inadequate risk analyses and activity reviews leave organizations vulnerable to cyberattacks. She urged regulated organizations to fully implement the HIPAA Security Rule.
OCR enforces HIPAA requirements that protect PHI across covered entities and business associates. Covered entities include health plans, healthcare clearinghouses, and most healthcare providers.
OCR recommends that regulated organizations take these steps to prevent or reduce cyberthreats:
- Identify every location where the organization maintains ePHI.
- Map how ePHI enters, moves through, and leaves information systems.
- Conduct periodic risk analyses and update them when necessary.
- Develop and implement risk management plans addressing identified risks and vulnerabilities.
- Establish audit controls that record information system activity and support examination.
- Review information system activity regularly.
- Implement authentication controls that restrict ePHI access to authorized users.
- Encrypt ePHI during transmission and storage when appropriate.
- Apply lessons from security incidents to the organization’s security management process.
- Provide regular HIPAA training tailored to the organization and each workforce member’s responsibilities.
The Risk Analysis provision requires regulated organizations (covered entities and their business associates) to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by that organization. Guidance about the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule, and the Security Rule’s Risk Analysis requirement, can also be found on OCR’s website.
Review the resolution agreement and corrective action plan for additional details.
When was the last time your organization updated its HIPAA security risk analysis?
Aris Medical Solutions can help you identify compliance gaps and prevent costly data breaches.
Schedule your HIPAA compliance review today and protect your organization from the next enforcement headline.
Your Trusted Partner for HIPAA Compliance since 2009