Originally published at ictfax.com

On 29 October 2026, HHS's Office for Civil Rights announced that Lehigh Valley Health Network will pay $800,000 over a 2023 ransomware attack that exposed records of 248,359 people. Two of the findings were a missing risk analysis and no regular review of system activity. A fax server holds years of patient records and keeps detailed logs. Those logs count as system activity, and somebody has to read them.

We'll be clear up front: this wasn't a fax breach. The attackers went after IT systems tied to Delta Medix, a physician practice in Scranton that Lehigh Valley acquired in 2021. But OCR's findings aren't specific to any one system. They apply to everything that stores electronic patient information, and fax infrastructure is one of the places they're most often missed.

What happened at Lehigh Valley

In February 2023, the BlackCat ransomware group, also known as ALPHV, got into systems supporting the Delta Medix practice.…