HIPAA Ransomware Evidence and Breach-Response Readiness
OCR's ransomware settlement exposes four audit-ready control failures.
On October 29, 2026, HHS OCR announced an $800,000 settlement and 3-year corrective-action plan with Lehigh Valley Health Network and affiliated entities. It is the agency's 22nd ransomware enforcement action. The 2023 breach affected 248,359 people and included exfiltration and dark-web disclosure of sensitive patient information.
Source: HHS OCR announcement
Why it matters
Incident response alone is not enough.
OCR expects organizations to produce dated evidence that ePHI risks were analyzed, system activity was reviewed, and breach-notification decisions were made within required timeframes. The corrective plan in this case requires a risk analysis, a risk-management plan, revised policies and role-based workforce training.
Status: the settlement and corrective plan bind the respondents. The underlying HIPAA Security and Breach Notification Rule obligations apply to regulated organizations more broadly.
The four failure areas OCR identified
- 01An accurate and thorough enterprise risk analysis
- 02Regular review of audit logs, access reports and security-incident tracking
- 03Permissible handling and disclosure of protected health information
- 04Timely notification to individuals and HHS
Audit-ready evidence checklist
Could you produce this evidence today?
Tick each item you could hand to an auditor this week, dated and signed. Your answers stay in this browser only.
0%
0 of 23 ready
01Enterprise risk analysis
0 / 6 ready02Audit logs, access reports and incident tracking
0 / 6 ready03Permissible use and disclosure of PHI
0 / 5 ready04Timely breach notification
0 / 6 readyThis checklist is a readiness aid, not legal advice. ThornBush Technologies | info@thornbushtech.com | +1 301 744 9554
The fixed-scope review
HIPAA Ransomware Evidence and Breach-Response Readiness Review
We use the checklist above to test your evidence, close the gaps and leave you with records you can produce on request.
01
ePHI data-flow and asset scoping
Confirm where ePHI lives and moves across systems, devices, cloud services and vendors.
02
Risk-analysis completeness
Test whether your risk analysis covers every ePHI system and leads to a working risk-management plan.
03
Log-review coverage and escalation
Check which sources are reviewed, how often, by whom, and when findings become incidents.
04
Incident and notification decision records
Review breach assessments, decision logs and 60-day clock evidence for past and test incidents.
05
Corrective-action tracking
Set up a dated tracker that turns gaps into owned, scheduled actions you can show an auditor.
06
Role-specific ransomware exercises
Run tabletop exercises for leadership, IT, privacy and clinical operations, with dated after-action notes.
What you receive
- Completed evidence checklist with gap ratings
- Dated corrective-action tracker with owners
- Exercise after-action notes
- Executive readout
Timeline and fee
Typically 2 to 4 weeks. Fixed-scope quote agreed before work begins, based on your organization type and systems in scope.
Not included
Legal opinions, breach-notification determinations, forensic investigation of an active incident, and remediation work beyond the agreed scope.
Who it's for
Health systems
Multi-site organizations that need enterprise-wide evidence across many systems and teams.
Specialty practices
Practices with lean IT and compliance staff that still carry full HIPAA obligations.
Business associates
Vendors and service providers that handle PHI and answer to their covered-entity clients.
A few questions, answered.
Is this a legal opinion?
No. ThornBush Technologies provides technical, operational and evidence-readiness support. Legal interpretations and breach-notification determinations should involve qualified counsel. We work alongside your counsel and give them organized, dated evidence.
Do you need access to our patient data?
No. We review policies, records, configurations, log-review evidence and decision logs. Where a sample is useful, we work with de-identified or redacted material, and we sign a business associate agreement if any PHI exposure is possible.
How long does the review take?
Most reviews run 2 to 4 weeks, depending on the number of systems in scope and how quickly evidence can be gathered. The scope, timeline and fee are fixed before work begins.
What do we receive at the end?
A completed evidence checklist with gap ratings, a dated corrective-action tracker with owners, exercise after-action notes, and an executive readout you can share with leadership or your board.
Does the OCR settlement apply to us?
The settlement and corrective plan bind only the named respondents. The underlying HIPAA Security Rule and Breach Notification Rule obligations apply to covered entities and business associates generally.
Your next step
Request your readiness review.
Please do not include patient information. We'll follow up to confirm scope, timeline and a fixed quote.