Three health systems are currently grappling with ransomware fallout, each at different stages. One is in the initial week of an attack, another is weeks into restoration, and the third is dealing with a federal corrective action plan following a 2023 incident. Together, these cases illustrate how operational disruption, litigation, and regulatory enforcement intersect. This analysis examines what your Governance, Risk, and Compliance (GRC) program must address before an incident occurs.
The Challenge
Each organization faced a cyberattack that escalated into a patient-care, legal, and compliance crisis simultaneously.
At the University of New Mexico Health Sciences Center, an attack forced the state's only Level-1 trauma center to divert ambulances, suspend surgeries, and cancel classes. University Hospitals in Ohio experienced an incident that took the MyChart patient portal offline, disrupted insurance pre-authorizations, and led to rescheduling appointments. Lehigh Valley Health Network faced a 2023 ransomware attack affecting over 248,000 people, resulting in an $800,000 settlement with the HHS Office for Civil Rights over potential HIPAA violations.
Environment and Constraints
These university-affiliated, multi-site health systems face recognizable constraints.
Clinical and research environments are interconnected. The threat actor in the UNM attack claimed to have compromised 36,000 devices. While UNM hasn't confirmed ransomware or data theft, the attacker offered a decryption key for devices affecting hospital operations. This highlights the risk of relying on an attacker's discretion if you can't segment and recover critical systems independently.
Reconnection is intentionally slow. University Hospitals is working with third-party experts to ensure systems are safe before reconnecting, with no clear timeline for normal operations. This necessary validation extends operational and legal exposure.
Public communication is often hampered by uncertainty. Neither UNM nor UH confirmed ransomware involvement or data compromise, yet both warned patients about potential scams. You'll need to communicate before having all the facts.
The Approach Taken
The responses show a consistent pattern.
Restore patient services first. UNM resumed patient services and classes within days. UH is restoring IT systems in phases.
Engage external expertise and law enforcement. UH is collaborating with cybersecurity experts and law enforcement to investigate and restore services.
Warn stakeholders about secondary fraud. Both systems advised patients to avoid clicking links or providing personal information in response to unexpected contact. UH emphasized it won't request banking information via calls or texts.
Avoid unverified public claims. Neither organization confirmed ransomware or data theft while facts were unsettled, protecting against potentially incorrect statements.
Results and Metrics
The outcomes are a mix of recovery and increasing exposure.
- UNM: Services resumed midweek. A law firm announced an investigation for potential class action litigation.
- UH: Restoration is ongoing with no recovery estimate. A proposed federal class action was filed, alleging negligence in protecting sensitive information.
- LVHN: The $800,000 HHS settlement is the 22nd ransomware-related enforcement action against a HIPAA-regulated organization. It includes a corrective action plan with three years of federal monitoring, requiring stronger information security practices. Earlier, LVHN agreed to a $65 million civil settlement after the BlackCat group posted stolen patient photographs.
Compare the numbers. The regulatory settlement was $800,000, while the civil settlement was $65 million. For planning, HIPAA Security Rule exposure isn't the largest financial risk; litigation is, and plaintiffs' counsel acted swiftly in the 2026 incidents.
The enforcement trend is significant. HHS issued its first ransomware settlement in 2023, a $100,000 fine against Doctors Management Group. Now, there are 22 actions. Ransomware enforcement has become routine.
What They Would Do Differently
While no retrospective has been published, analysis suggests areas for improvement. The corrective action plan at LVHN highlights gaps in information security risk analysis and management. Under the HIPAA Security Rule, these are foundational. A corrective action plan indicates that documented analysis and actual risk treatment didn't align with the threat.
Consider these questions for any health system:
- Did the risk analysis consider ransomware's impact on clinical operations, including trauma service diversion, beyond ePHI confidentiality?
- Could the organization restore life-safety systems independently? The UNM attacker's discretion in unlocking devices shows the risk when the answer is no.
- Was sensitive imaging data adequately protected? The LVHN case shows some data categories need controls beyond the baseline.
Takeaways for Your Team
Use risk analysis as evidence. Regulators will review whether your analysis was current, specific, and acted upon. Tie ransomware scenarios to your NIST Cybersecurity Framework (CSF) 2.0 functions and document risk treatment decisions.
Plan containment, eradication, and recovery around clinical dependencies. Map devices supporting real-time patient care and ensure they have segmented, tested recovery paths. HITRUST CSF and NIST SP 800-53 provide a structure for this.
Prepare for dual timelines. Operational recovery takes days, but litigation can start within a week, and regulatory scrutiny can last years. Assign owners for legal, regulatory, and communications workstreams in your incident response plan.
Pre-draft scam warnings. Having approved language ready saves time when facts are unclear.
Set communication rules for unconfirmed facts. Decide who can confirm ransomware or data theft and based on what evidence. Attacker claims aren't confirmation.
Budget for the largest exposure. If your cyber risk quantification stops at regulatory fines, it underestimates the problem. The LVHN case shows civil litigation can far exceed regulatory penalties.
The convergence of attack, litigation, and enforcement should be your planning assumption. Build your program so that when OCR asks for your risk analysis, it already answers the questions attackers posed about your recovery capability.
