The first task in the corrective action plan that Lehigh Valley Health Network signed in October is not a new firewall or a new product. It is a list. Before anything else, the health system has to compile an inventory of its electronic systems, so that the risk analysis that follows covers all of them.2 A list of what you own sounds like the easiest assignment in security. It is also the one that goes out of date first.
Last Thursday, October 29, the HHS Office for Civil Rights announced that the Pennsylvania health system had paid $800,000 and agreed to a three-year corrective action plan, which OCR counts as its 22nd ransomware enforcement action. On February 4, 2023, LVHN found suspicious activity that turned out to be ransomware. Data on 248,359 people was taken and posted on the dark web, including photographs of cancer patients receiving radiation oncology treatment, Social Security numbers, diagnoses and lab results.1 At the time, LVHN said the gang was BlackCat, which it described as associated with Russia, that the attack hit the network supporting one physician practice in Lackawanna County, and that it refused to pay the ransom.3 The practice was Lehigh Valley Physician Group Delta Medix, which LVHN had acquired in 2021.2 Within weeks, the gang posted images of patients undressed from the waist up.4
My argument is that security as a project and security as a practice are different kinds of work, and OCR's findings are about the second. A project has a deliverable and an end date: the risk analysis is finished, the tool is installed, the audit is passed. A practice is real only while it keeps happening: the logs are read this week, and the analysis is redone when the systems change. A corrective action plan is what it looks like when the regulator takes over the practice and sets its calendar. This is not a claim that LVHN did nothing, or that any single control would have stopped a ransomware gang. The agreement settles potential violations; it is not a court's verdict on what caused the attack.
What OCR found
OCR listed five potential violations. Three concern the breach itself: the impermissible disclosure of patient information, and late notice both to the people affected and to HHS.1 The rule's outer limit for each notice is 60 days.6 LVHN began notifying individuals in March 2023, but its breach report to HHS is dated May 15, 2023, about 100 days after it discovered the activity.12
The other two are the interesting ones, because they describe what was missing before anyone broke in. OCR says LVHN failed to conduct an accurate and thorough risk analysis of all of its electronic patient information, and failed to implement procedures to regularly review records of system activity, such as audit logs and access reports.1 Both are required by the HIPAA Security Rule, in nearly those words, and have been for two decades.5 OCR's director, Paula M. Stannard, drew the lesson in one line: "The best defense against cyberattacks is full implementation of the HIPAA Security Rule."1
Two kinds of work that share a name
A risk analysis looks like a project. It has a scope, a method, a document at the end and a date on the cover. Organizations buy it that way, often from a consultant, and file it. The trouble is that the document describes a system that keeps moving. New applications arrive, vendors change, staff leave, practices are bought. HHS's own guidance says the risk analysis process "should be ongoing." It sets no fixed frequency, but it names the events that should prompt an update, including a security incident, new technology and a change in ownership.7 An analysis that was accurate and thorough on the day it was signed becomes neither as soon as the network grows past it.
OCR does not publish what LVHN's analysis contained, so I can't say whether it was stale, narrow or never finished. But look at what the plan asks for first. The inventory has to be complete before the analysis begins, and the agreement applies to LVHN's legacy entities, fifteen of them listed in an appendix.2 That is a regulator insisting on knowing where the patient data lives, which is exactly the question an analysis done once cannot keep answering.
Activity review cannot be a project at all. A log exists to be read, and the reading has value only if it happens while an intruder is still inside. Done once a year, it becomes a record for the investigators. Becker's, citing earlier reporting, quoted the gang's leak post as saying it had been in LVHN's network "a long time."4 That is a criminal's boast, reported secondhand, and should be weighed as one. But it describes the kind of failure that regular review exists to cut short: the gap between when someone gets in and when anyone notices.
The receipt OCR handed back
The headline number is the first line, and it is paid once.
OCR stops reading the reports after year three. The rule does not stop.
The fine is the smallest line
Eight hundred thousand dollars is real money, but it is not the bill. In November 2024, a Lackawanna County judge gave final approval to a $65 million settlement of the patients' class action, with more than 134,000 people due a payment and most of the money going to patients whose images were published. LVHN continues to deny wrongdoing.8 The class settlement is about 80 times the OCR payment, before forensics, legal fees and the staff time a three-year plan consumes, none of which has been disclosed.
The plan is the part leaders underestimate. Its terms read like a description of a security practice with an auditor attached. LVHN must send OCR the scope and method of its new risk analysis within 30 days, deliver the analysis within 120 days of OCR's approval, follow it with an enterprise-wide risk management plan, update both at least annually, retrain its workforce every year, report certain events within 60 days, file annual reports and keep the records for six years.2 None of that is exotic. It is what the rule already asks for, done on a schedule OCR sets and checks.
Not one story
LVHN is not an outlier. OCR runs what it calls a Risk Analysis Initiative, and a June settlement with a retailer's health plan was its 14th enforcement action under it.9 Figure 2 lines up eight of the ransomware and hacking settlements OCR announced in 2026, with the agreements behind them. Each one cites a failure to conduct an accurate and thorough risk analysis. Seven followed ransomware; the eighth, Ambry Genetics, followed a phishing attack and also cited failures to terminate access and to assign unique user identities.9101112
From the breach report to the end of OCR's review
Drag across the sheet, or focus it and use the arrow keys.
Two things stand out. The first is the lag. The breaches were reported between 2020 and 2023, and the agreements came between three years and five months and six and a half years later. LVHN's was the fastest of the eight. Whatever an organization decides about its security program this year, the regulator's opinion of it may arrive in 2030. The second is that the requirement being enforced is old. HHS proposed a major update to the Security Rule in January 2025, but the federal regulatory agenda now lists it as a long-term action, with a final rule not expected before July 2027.14 OCR is not waiting. It is enforcing the rule that exists, and the rule that exists already asks for an ongoing analysis and regular review.
What you buy, you inherit
The detail I would underline for any organization that grows by acquisition, whether a health system, a physician group or a dental service organization, is that the attack came in through a practice bought two years earlier.2 An acquisition adds systems, vendors, accounts and logs on the day it closes, and it adds them to the buyer's obligations at the same moment, whether or not they are on the buyer's inventory yet. HHS's guidance lists a change in ownership among the reasons to revisit a risk analysis.7 Treated as a project, integration has a go-live date and a closing memo. Treated as a practice, the acquired practice enters the risk analysis and the log review before its network is joined to the rest, and someone owns the date.
Objections, considered
Eight hundred thousand dollars is a cost of doing business. For a health system of LVHN's size, it may be. That is why the fine is the wrong number to watch. The class settlement, the plan's three years of supervised work and the harm to patients whose photographs were published are the actual price, and the fine is the receipt that names the cause.
A risk analysis would not have stopped BlackCat. Perhaps not, and nobody can prove otherwise after the fact. The rule does not promise that any control prevents an attack. It requires the organization to know where its data is and to watch what happens to it, because those are what limit how far and how long an intruder can go unnoticed. OCR cited the missing disciplines, not the attack.
Better to wait for the new rule and do it once. That is the project mindset in its purest form. The proposed rule is parked, the current rule is being enforced, and its core requirements would survive any revision. Waiting is a decision to be measured against today's standard years from now.
Practices are expensive and hard to budget. They are harder to budget than projects, which is why they get skipped. The answer is to fund them as running costs with named owners and a calendar, the way the plan does. LVHN now has that structure. It simply did not get to choose it.
A risk analysis is true on the day it is signed; only the practice keeps it true.
Before the regulator sets the calendar
- When was our risk analysis last updated, and what has changed since: systems, vendors, staff, acquisitions?
- Who reviews system activity, and how often? What did the last review find, and what was done about it?
- Does every acquired practice enter the inventory and the risk analysis before its network joins ours, with a named owner and a date?
- Could we notify patients and HHS within 60 days of discovery, counting from the day we find the activity, not the day the forensics finish?
Back to the list at the top of LVHN's plan. An inventory of every system is a modest thing to ask for, and it will be wrong within the year: something will be added, retired or bought. The plan anticipates that, which is why it also says to update the analysis at least annually. The organizations that will not see their name in an OCR press release around 2030 are the ones keeping that list current now, without being asked.