News
Hospital Ransomware Attacker Sentenced to 70 Months in Federal Prison for Extorting Healthcare Targets · OCR EnforcementConduent Agrees to $80 Million Class-Action Settlement Over 62.2 Million-Record Healthcare Data Breach · Data BreachDenver Health Medical Plan Notifies 238,000 Members After Vendor SquareML Access-Key Leak Exposes Personal and Health Data · Data BreachByod Ransomware Group Claims Attack on UNM Health Sciences Center, Disrupting Surgeries and Ambulance Diversions at New Mexico's Only Level I Trauma Center · Data BreachInsomnia Ransomware Group Claims Attack on NorthShore Health Centers; Indiana Nonprofit Warns Patients of PHI Exposure · Data BreachQuest Diagnostics Discloses Breach of Quanum Lab Services Manager; Unauthorized Party Accessed Patient Records · Data BreachManhattan Law Firm Tarter Krinsky & Drogin Reports PHI Breach Affecting 196,645 Patients; Park Dental and Heritage Pediatrics Also Disclose Incidents · Data BreachMedical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched · Data BreachMid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents · Data BreachCentral Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated · Data BreachIvanti Connect Secure Zero-Day Exploited in Active Attacks Targeting Healthcare VPN Infrastructure · Data BreachMetaencryptor Ransomware Group Claims Attack on MyMichigan Health, University of Michigan-Affiliated 26-County Healthcare System · Data BreachPhoton Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health · Data BreachOracle Health / Cerner Breach Tally Climbs to Nearly 20 Million — Far Exceeding Earlier Disclosures · Data BreachHospital Ransomware Attacker Sentenced to 70 Months in Federal Prison for Extorting Healthcare Targets · OCR EnforcementConduent Agrees to $80 Million Class-Action Settlement Over 62.2 Million-Record Healthcare Data Breach · Data BreachDenver Health Medical Plan Notifies 238,000 Members After Vendor SquareML Access-Key Leak Exposes Personal and Health Data · Data BreachByod Ransomware Group Claims Attack on UNM Health Sciences Center, Disrupting Surgeries and Ambulance Diversions at New Mexico's Only Level I Trauma Center · Data BreachInsomnia Ransomware Group Claims Attack on NorthShore Health Centers; Indiana Nonprofit Warns Patients of PHI Exposure · Data BreachQuest Diagnostics Discloses Breach of Quanum Lab Services Manager; Unauthorized Party Accessed Patient Records · Data BreachManhattan Law Firm Tarter Krinsky & Drogin Reports PHI Breach Affecting 196,645 Patients; Park Dental and Heritage Pediatrics Also Disclose Incidents · Data BreachMedical Data Rx Breach: The Gentlemen/VYPR Ransomware Group Claims Attack on Michigan Healthcare IT Vendor; Class Action Investigation Launched · Data BreachMid Florida Dermatology & Plastic Surgery Discloses Breach Affecting 85,585 Patients; Kannarr Eye Care and Indiana University Health Also Report Incidents · Data BreachCentral Ohio Primary Care Physicians Discloses Vishing-Triggered Breach Affecting 1.4 Million Patients and Employees; 'Chaos' Ransomware Group Implicated · Data BreachIvanti Connect Secure Zero-Day Exploited in Active Attacks Targeting Healthcare VPN Infrastructure · Data BreachMetaencryptor Ransomware Group Claims Attack on MyMichigan Health, University of Michigan-Affiliated 26-County Healthcare System · Data BreachPhoton Health, Healthcare Highways, and Any-Time Home Care Disclose Data Breaches; Direwolf Ransomware Group Claims Attack on Photon Health · Data BreachOracle Health / Cerner Breach Tally Climbs to Nearly 20 Million — Far Exceeding Earlier Disclosures · Data Breach
settlement

HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network: Corrective action / RA

Resolution Oct 2026

Penalty

Corrective action / RA

Action type

Settlement

Entity profile

—

Case number

—

What went wrong

HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network

Timeline

  • ResolutionOct 2026
  • Incident and investigation milestones are not consistently published by OCR in machine-readable form.

Key takeaways for your organization

  • Align policies, procedures, and evidence with the specific CFR provisions cited in OCR resolutions affecting your entity type.
  • Run tabletop exercises for breach response, OCR inquiry handling, and privilege-preserving communications with counsel.
  • Revisit business associate inventory and downstream vendor security assurances after major enforcement themes in your sector.

Related actions

Ending Anti-Semitism on College Campuses

—

,

Keeping Food Ingredients Safe

—

,

Ambry Genetics to Pay $700,000 After Phishing Attack Exposed 225,000 Patients' Health Data

—

$700,000

Source

U.S. Department of Health and Human Services release

Source: U.S. Department of Health and Human Services, Office for Civil Rights. medcomply.ai aggregates public materials for educational use, not legal advice.