What the $800K Lehigh Valley HIPAA Settlement Says About Risk Analysis, Including Old Devices

By RedKey USB. Published November 2, 2026. Facts about the settlement come from the HHS Office for Civil Rights announcement. Regulatory text comes from the eCFR and HHS guidance, all linked in the sources. This is general information, not legal advice.

A HIPAA risk analysis is the foundation of everything else the Security Rule asks for, and on October 29, 2026 it was again at the center of an enforcement action. This guide walks through what the Lehigh Valley settlement says, what the Security Rule requires, and how to make sure your own HIPAA risk analysis includes the least glamorous part of your environment: the old drives, laptops and media waiting in a closet, and the erasure evidence you keep when they leave.

What did OCR announce about Lehigh Valley Health Network?

HHS OCR announced a settlement with Lehigh Valley Health Network (LVHN) and its affiliated covered entities over potential violations of the HIPAA Privacy, Security and Breach Notification Rules. LVHN agreed to a three-year corrective action plan and paid $800,000 to OCR.^[1] OCR called it its 22nd ransomware enforcement action.^[1]

The facts as OCR describes them: on May 15, 2023, LVHN, a Pennsylvania health system, filed a breach report stating that on February 4, 2023 it discovered suspicious activity in its IT system that was determined to be ransomware. PHI was exfiltrated and posted on the dark web. The attack affected the PHI of 248,359 individuals and included sensitive photographs of cancer patients receiving radiation oncology treatment, as well as names, addresses, dates of birth, Social Security numbers, driver's license numbers, financial information, diagnoses, lab results, medications and treatment information.^[1]

OCR found that LVHN had potentially violated the rules, including by failing to conduct an accurate and thorough risk analysis of the risks and vulnerabilities to the confidentiality, integrity and availability of all of its ePHI, failing to implement procedures to regularly review records of information system activity, impermissibly disclosing the PHI of 248,359 individuals, and failing to timely notify affected individuals and the HHS Secretary of a breach of unsecured PHI.^[1] OCR Director Paula M. Stannard said that failure to conduct an accurate and thorough risk analysis and to regularly review information system activity makes regulated entities attractive targets for cyberattacks.^[1]

Under the corrective action plan, LVHN committed to conduct an accurate and thorough risk analysis, develop and implement a risk management plan, review and revise its policies and procedures, and review its workforce training materials.^[1] To be clear, this is OCR's account of a settlement. OCR describes the violations as potential, and the announcement does not say anything about retired devices or old media.

What does a HIPAA risk analysis have to cover?

The Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI they hold. It is a required implementation specification, 45 CFR 164.308(a)(1)(ii)(A).^[4] HHS's risk analysis guidance adds a few points that matter for this article:

• Scope is all ePHI in all forms of electronic media. HHS says this includes hard drives, CDs, DVDs, smart cards or other storage devices and portable electronic media, whether a single workstation or a complex network.^[2]
• You must identify where ePHI is. An organization must identify where ePHI is stored, received, maintained or transmitted, and document what it learns.^[2]
• It must be documented and ongoing. The Rule requires documentation but no specific format, and the process should be ongoing, repeated when circumstances change.^[2]
• There is no endorsed method. HHS says there is no single method that guarantees compliance and that it does not endorse any particular risk analysis model.^[2]

OCR's own recommendations in the LVHN announcement start from the same place: identify where ePHI is located in the organization, including how ePHI enters, flows through and leaves the organization's information systems, and periodically conduct and update a risk analysis with a risk management plan.^[1]

Where do retired drives and devices fit?

They sit at the point where ePHI leaves your organization. A laptop returned from a departing employee, a server drive replaced during an upgrade, a copier or workstation hard drive, a backup disk or USB drive in a drawer: each of these may still hold ePHI, and each is electronic media within the scope HHS describes.^[2] The Security Rule does not use the words "asset inventory", but in practice you cannot identify where ePHI is stored without a list of the devices and media that could hold it. Retired and spare devices need to be on that list until they have been erased or destroyed and the record kept.

Risk analysis also covers the process, not just the hardware. Questions worth putting in your analysis: Who authorizes retiring a device? Where is it stored before disposal and who can access it? How long does that take? Is the drive erased before it is sent to a recycler, donated, resold or reissued? How do you know it was?

What do the HIPAA device and media controls require?

The physical safeguards include a device and media controls standard: implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, and the movement of these items within the facility. It has four implementation specifications:^[3]

• Disposal (required): policies and procedures to address the final disposition of ePHI and/or the hardware or electronic media on which it is stored.
• Media re-use (required): procedures for removal of ePHI from electronic media before the media are made available for re-use.
• Accountability (addressable): maintain a record of the movements of hardware and electronic media and any person responsible for them.
• Data backup and storage (addressable): create a retrievable, exact copy of ePHI, when needed, before movement of equipment.

HHS explains in its FAQ that a covered entity may reuse or dispose of computers or other electronic media that store ePHI, but only if certain steps have been taken to remove the ePHI before disposal or reuse, or if the media itself is destroyed. Depending on the circumstances, appropriate methods may include clearing (using software or hardware products to overwrite media with non-sensitive data) or purging, and destruction methods may include shredding or incinerating the media. HHS also points readers to NIST SP 800-88, Guidelines for Media Sanitization, for practical information.^[5] An addressable specification is not optional: if you decide it is not reasonable and appropriate, you must document why and adopt an equivalent measure if reasonable.^[2] For a fuller walkthrough, see our guide to HIPAA media sanitization requirements.

How do you add old devices to your HIPAA risk analysis?

1. Inventory everything that could hold ePHI, including devices that are no longer in use, spares, loaners, copiers, backup media and removable drives. Record the device, owner, location and status.^[2]
2. Add the retirement process to the analysis. Document the threats and vulnerabilities at each step: storage before disposal, transport, handoff to a recycler, reuse. Assign likelihood and impact, and record the corrective actions.^[2]
3. Write down the disposal and media re-use procedure, naming who does it, which method applies to which media (clear, purge or destroy) and which standard you follow. NIST SP 800-88 is the reference HHS points to.^[5][6]
4. Erase before the device leaves your control. Use a proper wipe of the whole drive, not deleting files, a quick format or a reinstall.
5. Keep evidence for each device: what it was, when, how it was erased and by whom, and what happened to it next. This supports the accountability record the Rule describes.^[3]
6. Review and repeat. Update the analysis when you change systems, vendors or locations, and make retired devices part of each review.^[2]

Where does a documented erasure report fit?

The Security Rule does not name an erasure report, and HHS does not endorse any tool. What it does require is a disposal and media re-use procedure, and it describes keeping a record of movements as an addressable specification.^[3] A documented erasure report for each device is a practical way to show that your procedure was followed for that particular drive, and your risk analysis documentation can reference it. It does not replace the policy, the inventory or your own review.

RedKey USB is built for the erasure step. You start a PC, laptop or Intel Mac from the RedKey stick and it erases the drives you choose outside the operating system: hard drives, SATA SSDs, NVMe SSDs, SCSI and SAS drives, USB flash drives and memory cards. The default wipe also removes hidden areas such as the HPA and DCO on ATA/SATA drives, and supported hidden areas on SCSI drives, automatically. It supports the clear and purge methods described in NIST SP 800-88, using the drive's own erase commands where supported and overwriting otherwise, with results depending on the drive and computer.^[6] RedKey Professional and Ultimate produce a PDF erasure report for each job, which you can keep with your inventory. RedKey Home shows results on screen only. If you also retire phones and tablets, mobile device wiping is available in Ultimate only. For the process around the wipe, read how to wipe retired computers without risk and our NIST data sanitization guide for IT teams.

What this does not mean

It does not mean OCR blamed old devices for the LVHN breach, because the announcement says nothing of the kind. It does not mean that wiping drives satisfies a risk analysis, which is a much broader exercise covering your systems, people and processes. And it does not mean any product, including RedKey, satisfies HIPAA for you. HHS does not endorse tools, and your obligations depend on your organization, so speak to your compliance officer or counsel about your own situation.

The bottom line

The LVHN settlement is a reminder that OCR keeps returning to the risk analysis. Make yours accurate and thorough by including every place ePHI can sit, including the devices at the end of their life. Write down your disposal and media re-use procedure, erase before devices leave your control, and keep a documented erasure report for each one.

HIPAA risk analysis and old devices FAQs

What did OCR say Lehigh Valley Health Network did wrong?

According to HHS OCR's October 29, 2026 announcement, OCR found LVHN had potentially violated the HIPAA Privacy, Security and Breach Notification Rules, including by failing to conduct an accurate and thorough risk analysis of the risks and vulnerabilities to all of its ePHI, failing to implement procedures to regularly review records of information system activity, impermissibly disclosing the PHI of 248,359 individuals, and failing to timely notify affected individuals and the HHS Secretary of a breach of unsecured PHI. LVHN agreed to a three-year corrective action plan and paid $800,000.

Did the Lehigh Valley settlement involve old or retired devices?

No. OCR's announcement describes a ransomware attack on LVHN's IT system and does not mention retired devices or media. The link to old devices in this article is a lesson drawn from the Security Rule, which covers ePHI in all forms of electronic media and requires device and media controls, not something OCR said about LVHN.

Does a HIPAA risk analysis have to include retired hard drives and devices?

HHS's guidance says the scope of a risk analysis includes ePHI in all forms of electronic media, such as hard drives and other storage devices or portable electronic media, and that an organization must identify where its ePHI is stored. A drive that still holds ePHI, including one waiting for disposal, is ePHI in electronic media, so it belongs in the analysis.

What does HIPAA require when disposing of or reusing devices that held ePHI?

The Security Rule's device and media controls standard has two required implementation specifications: disposal, meaning policies and procedures for the final disposition of ePHI and the hardware or media it is stored on, and media re-use, meaning procedures to remove ePHI from media before it is made available for re-use. Maintaining a record of movements of hardware and media and who is responsible is an addressable specification.

Is an erasure report required by HIPAA?

The Security Rule does not name an erasure report. It requires disposal and media re-use procedures, and an accountability record of movements of hardware and electronic media is an addressable specification. A documented erasure report for each drive is one practical way to keep evidence that the procedure was followed. It is not a substitute for your policies, and HHS does not endorse any particular tool.

Which RedKey editions produce a PDF erasure report?

RedKey Professional and Ultimate produce a PDF erasure report. RedKey Home shows results on screen only. Mobile device wiping is available in RedKey Ultimate only.

Sources

1. HHS Office for Civil Rights, HHS' Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health Network (October 29, 2026)
2. HHS, Guidance on Risk Analysis
3. eCFR, 45 CFR 164.310 Physical safeguards
4. eCFR, 45 CFR 164.308 Administrative safeguards
5. HHS, May a covered entity reuse or dispose of computers or other electronic media that store electronic protected health information? (FAQ 578)
6. NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)

This article is general information, accurate as of November 2, 2026, and based on the HHS OCR announcement, the eCFR, HHS guidance and NIST sources listed. Settlement details are as described by OCR. HHS does not endorse any product or method. It is not legal advice.