The $800,000 HIPAA Lesson: Risk Analysis and Log Review for Medical Groups

On October 29, the HHS Office for Civil Rights (OCR) announced that Lehigh Valley Health Network (LVHN) paid $800,000 and agreed to a three-year corrective action plan after a ransomware attack exposed the health information of 248,359 people. It is OCR's 22nd ransomware enforcement action.

The two Security Rule failures OCR named are the ones we see most often in growing medical groups. There was no accurate and thorough risk analysis covering all electronic protected health information (ePHI), and no regular review of system activity such as audit logs and access reports. According to The HIPAA Journal, the attackers got in through IT systems tied to Delta Medix, a company LVHN acquired in 2021.

If your group has added locations, bought practices, or merged with another group, this case is about you. Here is what happened, what OCR expects, and a 15-minute check you can run every Monday.

Executive takeaway

• What happened: LVHN discovered suspicious activity on February 4, 2023 that turned out to be ransomware. Patient data was stolen and posted on the dark web, including photographs of cancer patients receiving radiation treatment. (HHS)
• What OCR found: Potential failures to conduct an accurate and thorough risk analysis, to regularly review information system activity, and to notify patients and HHS on time.
• The acquisition angle: The HIPAA Journal reports that the ALPHV/BlackCat group breached IT systems related to Delta Medix, acquired in 2021. The ransom was not paid, and a related class action settled for $65 million. (The HIPAA Journal)
• The Defensible IT test: Could you show a regulator a dated risk analysis that covers every location and every acquired practice, plus proof that someone reviewed your logs last week?

What happened at Lehigh Valley Health Network?

LVHN, a Pennsylvania health system, discovered suspicious activity in its IT environment on February 4, 2023, and later confirmed ransomware. It filed its breach report with OCR on May 15, 2023. The stolen data included names, addresses, dates of birth, Social Security numbers, driver's license numbers, financial information, diagnoses, lab results, medications, and treatment information.

OCR Director Paula M. Stannard said: "Failure to conduct an accurate and thorough risk analysis and to undertake regular review of information system activity makes regulated entities attractive targets for cyberattacks." She added: "The best defense against cyberattacks is full implementation of the HIPAA Security Rule."

Why does breach notification timing matter?

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. For breaches affecting 500 or more people, HHS must be notified within the same window. (HHS Breach Notification Rule) LVHN's discovery and its breach report were 100 days apart, and OCR cited late notice to both patients and the Secretary.

The HIPAA Journal counts notification failures in five of the 12 HIPAA settlements announced this year. Late notice is now a routine part of these cases, not an afterthought.

What does OCR expect from a HIPAA risk analysis?

The Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI you hold (45 CFR 164.308(a)(1)(ii)(A)). OCR's own recommendations start with knowing where ePHI is located, including how it enters, flows through, and leaves your systems.

For a multi-location group, "all ePHI" means every clinic, every imaging and lab system, every billing connection, and every practice you acquired along with its old servers, shared passwords, and vendor accounts.

What counts as regular review of information system activity?

The rule also requires procedures to regularly review records of system activity, such as audit logs, access reports, and security incident tracking reports (45 CFR 164.308(a)(1)(ii)(D)). Collecting logs is not the same as reviewing them. OCR wants to see that a person looked, what they found, and what happened next.

Why are acquired practices the weak spot?

When a medical group buys a practice, it usually buys that practice's IT too: the old firewall, the local server under the front desk, the remote access tool a vendor set up years ago, and accounts nobody has turned off. Those systems often run for months outside the main security program while the deal closes and the EHR migration waits.

In LVHN's case, the HIPAA Journal reports that the attackers breached systems related to an acquired company. The lesson for growing groups is simple. A new location joins your risk analysis on the day you take responsibility for it, not when the integration project finishes.

What should a medical group check this month?

1. Update the risk analysis. Make sure it names every location, acquired practice, and system that holds ePHI, and that it is dated this year.
2. Turn on and review audit logs. Cover the EHR, email, VPN, and remote access tools, and keep a dated record of each review and its outcome.
3. Inventory acquired IT. List every server, firewall, remote access tool, and vendor account that came with an acquisition, then retire or bring each one under management.
4. Enforce MFA everywhere. Every remote path into ePHI, including vendor access, should require multi-factor authentication.
5. Confirm EDR coverage across all sites. Pull the report and compare it with your device list for each location.
6. Rehearse the breach clock. Know who decides whether an incident is a breach, and how you will meet the 60-day deadline.

What is the Monday 15-minute HIPAA drift check?

Controls drift between audits. A short weekly check catches it early. Every Monday, the practice administrator or compliance lead asks the IT provider for three things:

• A date: When was the risk analysis last updated, and does it include every location and acquired practice?
• A number: How many log review items were opened last week, and how many were closed?
• A screenshot: EDR and MFA coverage across every site, with any gaps named.

Add one more question each quarter: if we found ransomware tonight, who starts the breach clock, and who is on the call? If your provider cannot answer these in 15 minutes, you have found your gap.

What should we ask our IT provider in writing?

• Does our risk analysis cover every location and every acquired practice, and when was it last updated?
• Who reviews our audit logs, how often, and where are the records?
• Which systems from acquired practices are still outside your management?
• Is MFA enforced on every remote connection, including vendor accounts?
• If ransomware hit one clinic tonight, what would you see, and what would you do first?

Standard IT vs. Defensible IT: what is the difference for a medical group?

Standard IT keeps each clinic running. Defensible IT can prove to OCR that every clinic is covered.

Standard IT says "we have logs." Defensible IT can show who reviewed them last week and what they did about it.

Standard IT looks like this:

• A risk analysis done once, before the last two acquisitions.
• Audit logs collected but rarely read.
• Acquired practices left on their old IT until the EHR migration.
• MFA on email, but not on every vendor remote access tool.
• A breach plan nobody has rehearsed.

Defensible IT looks like this:

• A risk analysis updated whenever a location or system is added.
• Log review on a set schedule, with dated records and follow-up.
• Acquired IT brought under management from day one, with same-day critical updates and dated tickets as part of compliance-first managed IT services.
• MFA and EDR on every site and every remote path into ePHI.
• 24x7 managed detection and response, with evidence collected into an automatically updated compliance binder.

How does Emry Networks help medical groups in Jacksonville FL, Manchester NH, and nationwide?

Emry Networks provides managed IT, cybersecurity, and HIPAA compliance for multi-location medical groups and other regulated industries across the United States, from hubs in the Jacksonville, FL and Manchester, NH areas. We work on all-inclusive flat monthly pricing, so adding a location does not bring a surprise invoice. Every engagement follows a 90-day blueprint:

• Phase 1 (Days 1-30): Scoping, a baseline gap assessment, and software deployment. We map where ePHI lives at every site, including acquired practices, and deploy EDR, logging, and device management.
• Phase 2 (Days 31-60): Tool implementation and policy authoring. We put MFA, log review, patching, and backup controls in place, and write policies that match what actually runs.
• Phase 3 (Days 61-90): Verification and a second gap assessment. We test the controls, update the risk analysis, and hand you before-and-after evidence.

Not sure your risk analysis covers every clinic? Book a 30-Minute Risk Assessment. We will review your risk analysis, your log review process, and your acquired IT, and tell you plainly what OCR would ask about.

Next Steps for Your Medical Group

• Take the free Compliance Readiness Assessment to see where you stand.
• Read our guide on which compliance framework applies to your business.
• Book a 30-Minute Risk Assessment with our team.

Frequently asked questions

Why did Lehigh Valley Health Network pay $800,000?

OCR found potential HIPAA violations after a 2023 ransomware attack that affected 248,359 people. They included no accurate and thorough risk analysis, no regular review of information system activity, an impermissible disclosure, and late breach notification. LVHN also agreed to a three-year corrective action plan.

Does a HIPAA risk analysis have to cover acquired practices?

Yes. The Security Rule requires an assessment of risks to all ePHI you hold. Once you are responsible for an acquired practice's systems and data, they belong in your risk analysis.

How often should a medical group review audit logs?

HIPAA requires regular review but does not set a fixed frequency. Choose a schedule based on your risk analysis, document it, and keep dated records showing each review and its follow-up. Many groups pair this with a short weekly check.

How long do we have to report a HIPAA breach?

Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. If a breach affects 500 or more people, HHS must be notified within the same window, and a breach affecting more than 500 residents of a state also requires notice to prominent media outlets there.

What is the Monday 15-minute HIPAA drift check?

It is a weekly check where you ask your IT provider for three things: the date of the last risk analysis update, the number of log review items opened and closed last week, and a screenshot of EDR and MFA coverage across every site.