OCR fines Lehigh Valley Health Network $800,000 for HIPAA violations
Lehigh Valley Health Network agreed to pay $800,000 and adopt a corrective action plan after OCR found HIPAA Security Rule and Breach Notification Rule violations related to a ransomware attack.
- Framework
- HIPAA
- Who it concerns
- Lehigh Valley Health Network, a Pennsylvania health system.
What changed?
Each point with the sentence from the source that says it.
Lehigh Valley Health Network failed to conduct a comprehensive and accurate risk analysis to identify risks and vulnerabilities to electronic PHI.
Lehigh Valley Health Network was determined to have failed to conduct a comprehensive and accurate risk analysis to identify risks and vulnerabilities to electronic PHI
Lehigh Valley Health Network failed to implement policies and procedures for regularly reviewing records of activity in information systems containing ePHI.
failed to implement policies and procedures for regularly reviewing records of activity in information systems containing ePHI, such as audit logs, access reports, and security incident tracking reports
Lehigh Valley Health Network failed to issue timely notifications to affected individuals and to the Secretary of HHS.
Lehigh Valley Health Network failed to issue timely notifications to the affected individuals to alert them to the theft of their personal and health information and did not issue a timely notification to the Secretary of the Department of Health and Human Services
Lehigh Valley Health Network agreed to pay an $800,000 financial penalty and adopt a corrective action plan.
will pay an $800,000 financial penalty and adopt a corrective action plan to address identified areas of noncompliance
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Security Risk Analysis (SRA) Report
Review the Security Risk Analysis (SRA) Report to ensure it includes a comprehensive and accurate risk analysis of ePHI.
- Audit Controls Policy
Review the Audit Controls Policy to ensure it includes regular review of information system activity records.
- HIPAA Breach Notification Policy
Review the Breach Notification Policy to ensure timely notification to individuals and the Secretary of HHS.