On 29 October 2026, HHS’s Office for Civil Rights announced that Lehigh Valley Health Network will pay $800,000 over a 2023 ransomware attack that exposed records of 248,359 people. Two of the findings were a missing risk analysis and no regular review of system activity. A fax server holds years of patient records and keeps detailed logs. Those logs count as system activity, and somebody has to read them.
We’ll be clear up front: this wasn’t a fax breach. The attackers went after IT systems tied to Delta Medix, a physician practice in Scranton that Lehigh Valley acquired in 2021. But OCR’s findings aren’t specific to any one system. They apply to everything that stores electronic patient information, and fax infrastructure is one of the places they’re most often missed.
What happened at Lehigh Valley
In February 2023, the BlackCat ransomware group, also known as ALPHV, got into systems supporting the Delta Medix practice. Lehigh Valley refused to pay a ransom demand reported at more than $5 million. The group then posted stolen data on its leak site, including photographs of more than 600 cancer patients taken during radiation treatment.
The exposed data included names, addresses, dates of birth, Social Security and driver’s license numbers, financial details, diagnoses, lab results, medications and treatment information. Lehigh Valley reported the breach to HHS on 15 May 2023. A separate class action, approved in November 2024, settled for $65 million.
Sources: OCR’s 29 October 2026 announcement as reported by HIPAA Journal and Medical Daily.
OCR’s findings cover all three HIPAA rules:
- Security Rule: no accurate and thorough risk analysis, and no procedures to regularly review records of information system activity, such as audit logs, access reports and security incident tracking.
- Privacy Rule: an impermissible disclosure affecting 248,359 people.
- Breach Notification Rule: notice to patients and to HHS went out late. The rule allows no more than 60 days from discovery. This took about three months.
On top of the $800,000, Lehigh Valley agreed to a corrective action plan that OCR will monitor for three years. The plan covers a new risk analysis, a risk management plan, revised policies and workforce training. OCR Director Paula M. Stannard said failure to do a risk analysis and “to undertake regular review of information system activity makes regulated entities attractive targets.” HIPAA Journal counts it as the 22nd ransomware investigation to end in a financial penalty.
Why the log finding matters for fax
We’ve covered risk analysis and unique user IDs on fax systems before. The finding that’s new here is information system activity review, 45 CFR 164.308(a)(1)(ii)(D). It’s a required implementation specification, not an addressable one. Every covered entity has to do it.
A fax server is a natural place for this to go wrong. It usually sits slightly apart from the main IT estate. It’s often been there for years, sometimes inherited with a practice the organisation bought, which is exactly how Delta Medix came to Lehigh Valley. It logs every login, every transmission and every configuration change. And it’s rare for anyone to read those logs unless a fax goes missing.
The logs do two jobs. Read weekly, they show you an intrusion while it’s still small. And after an incident, they’re how you answer the question the Breach Notification Rule makes urgent: what was taken, from whom, and when. Lehigh Valley’s notice ran past the 60-day limit. A fax archive whose logs nobody has looked at in years is very slow to scope.
A weekly review that fits in 20 minutes
You don’t need a security operations centre for this. You need five questions, someone who owns them, and a written answer every week.
Write down the answer every week, including “nothing unusual”.
- Who signed in, and from where? Look for logins outside working hours, from addresses you haven’t seen before, and to accounts belonging to people who’ve left.
- Did anyone pull a lot of old faxes at once? Bulk downloads or exports from the inbound archive are what data theft looks like from inside the system.
- Where did outbound faxes go that they never went before? Look for new destination numbers, especially international ones, and unusual volume from a single sender.
- What changed in the configuration? New users, new admin accounts, and routing rules that suddenly forward inbound faxes to an email address.
- Is the log itself complete? A gap in the dates, a full disk or a log that stopped writing is a finding in its own right.
The written record matters more than the review itself. “We review logs” is a claim. A dated note for every week since March is evidence, and it’s the first thing an investigator will ask for.
Three things to fix this month
- Find every fax system you own, including the inherited ones. Acquisitions are where forgotten servers live. If you bought a practice, check what it was faxing with and whether that box is still running.
- Make sure the logs go somewhere you control. If they live only on the fax server, an attacker who gets in can erase them. Copy them off the box, keep them for as long as your retention policy says, and check they can’t be quietly edited.
- Put the fax server in the risk analysis by name. Not as “the network”. As a system holding patient records, with its own logs, owner and review schedule.
Running your own fax server makes this easier, because the logs, the archive and the retention rules are all on systems you control. Our ICTFax fax server software page explains what a self-hosted setup includes.
Frequently asked questions
How much did Lehigh Valley Health Network pay OCR?
$800,000, plus a corrective action plan that OCR will monitor for three years. OCR announced it on 29 October 2026. A separate $65 million class action settlement over the same breach was approved in November 2024.
Was the Lehigh Valley breach caused by fax?
No. It was a BlackCat ransomware attack on IT systems tied to Delta Medix, a practice the health network acquired in 2021. We use it because OCR’s Security Rule findings apply to every system that holds patient records, fax servers included.
Is reviewing system activity required or addressable under HIPAA?
Required. Information system activity review, 45 CFR 164.308(a)(1)(ii)(D), is a required implementation specification under the security management process standard.
How often should we review fax server logs?
HIPAA doesn’t set a frequency. It asks for regular review that fits your risk analysis. Weekly is a sensible default for a system holding patient records. Whatever schedule you choose, write it down and keep a record of each review.
What does the 60-day breach notification limit mean in practice?
You must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. Breaches affecting 500 or more people must also go to HHS within the same window. Good logs are what let you work out who was affected in time.