Good morning everyone,

As November begins, this week’s developments put risk analysis, incident documentation, and vendor oversight back in focus. OCR’s latest ransomware settlement addresses weaknesses in monitoring and breach notification, while new federal health IT certification changes call for careful review of vendor roadmaps and internal requirements.

The five updates below cover developments published, updated, or newly reported October 27–November 2. Our practical focus: verify which systems hold patient information, test how essential care continues during an outage, and retain evidence showing how your team evaluates and resolves risk.

Regulatory & Legal Updates

Lehigh Valley Health Network pays $800,000 to resolve OCR ransomware investigation (Announced October 29, 2026)

What happened: HHS OCR announced an $800,000 settlement with Lehigh Valley Health Network and its affiliated covered entities, accompanied by a three-year corrective action plan. The investigation followed a February 2023 ransomware incident affecting 248,359 individuals. Stolen information included clinical and financial data and sensitive photographs of patients receiving radiation oncology treatment.

OCR identified potential violations involving risk analysis, review of system activity, impermissible disclosure, and delayed notification to patients and HHS. The current development is the enforcement settlement. (HHS announcement)

Why it matters: This case provides a practical agenda for checking whether risk assessment findings lead to operational safeguards and whether incident decisions are documented promptly. Include imaging and specialty-care repositories when reviewing sensitive information.

Recommended actions:

• Compare your ePHI inventory with the scope of your latest risk analysis; assign owners to uncovered repositories and unresolved findings.
• Sample recent audit-log reviews and verify that suspicious activity produced documented investigation and follow-up.
• Exercise the notification decision process with privacy and legal staff; record discovery dates, decision owners, required notices, and supporting evidence.

HTI-5 final rule changes health IT certification requirements (Published October 28, 2026)

What happened: HHS published the HTI-5 final rule, removing 14 certification criteria and revising seven while retaining 39 unchanged. Changes include decision-support and information-exchange criteria, alongside reduced developer testing and reporting requirements. The Federal Register specifies a general effective date of December 28, 2026, with specified amendments effective January 1, 2027; individual provisions also have their own transition timing. (Final rule; ONC overview; criteria and timing)

Why it matters: Certification changes warrant a discussion with EHR and digital-health vendors about product functionality, contractual commitments, and the controls your organization still needs. A feature’s removal from certification criteria should prompt an internal impact assessment before anyone disables it.

Recommended actions:

• Request a written vendor crosswalk identifying affected modules, criteria, implementation dates, and planned functionality changes.
• Have clinical informatics, privacy, security, and legal teams review implications for decision support, patient access, and sensitive-data exchange.
• Update procurement checklists to distinguish certification requirements from capabilities your organization requires through contract or internal policy.

Breach & Incident Notices

UNM restores clinical operations and warns of incident-related scams (Updated October 27–28, 2026)

What happened: The University of New Mexico reported restored critical electronic systems on October 27 and fully functional clinical operations on October 28 after an October 26 cybersecurity incident. The disruption caused a two-hour ambulance diversion and suspended outpatient surgeries and appointments for the remainder of that day.

UNM said its assessment identified affected end-user devices without penetration of core systems or servers. It also warned patients and staff against engaging with anyone claiming responsibility or offering compensation. The incident remained under criminal investigation; the update did not establish a confirmed patient-data breach total. (UNM updates)

Why it matters: Use this incident to test both clinical continuity and public communications. Recovery planning should account for postponed care, while communications should help patients recognize fraudulent follow-up messages.

Recommended actions:

• Exercise ambulance diversion, downtime scheduling, and referral arrangements with clinical leadership and regional partners.
• Assign responsibility for reconciling canceled procedures, appointments, and outstanding patient communications.
• Prepare an incident-response script directing patients to verified channels; preserve suspicious messages and route them to security for review.

Vendor & Supply Chain Risk

Blueberry Pediatrics breach reporting identifies 340,915 affected individuals (Reported October 28, 2026)

What happened: HIPAA Journal reported an affected population of 340,915 in Blueberry Pediatrics’ previously disclosed Metabase-related incident, citing an Oregon attorney general report. Its coverage also described a related incident at prescription-service provider Photon involving overlapping patient information.

Blueberry’s consumer notice dates discovery to August 22 and identifies potentially affected names, birth dates, insurance details, and clinical information. It states that separately stored clinical photos and videos, Social Security numbers, and payment information were not involved. The company reported containment, patching, credential changes, and additional vendor-vulnerability monitoring. (October 28 reporting; company consumer notice)

Why it matters: Reporting and analytics environments deserve explicit attention in vendor reviews. Overlapping incidents also require careful reconciliation so patient communications accurately explain which services and data were involved.

Recommended actions:

• Inventory reporting tools and exported datasets containing PHI, including vendor-managed and internally hosted analytics environments.
• For affected services, request an organization-specific patient list, exposed data fields, incident timeline, and confirmation of notification responsibilities.
• Reconcile overlapping vendor notices and maintain one incident chronology linking each supplier’s findings, remediation evidence, and unresolved questions.

Breach Trends & Risk Management

Newly published August breach analysis counts 52 large reports (Published October 30, 2026)

What happened: HIPAA Journal’s August 2026 analysis counted 52 breaches affecting at least 8,377,327 individuals. Its reported month-to-month figures decreased from July, but its year-to-date count reached 593 large breaches—6.7% above the comparable prior-year total. These are historical reporting figures analyzed this week, rather than incidents that all occurred during the current week. (August breach report)

Why it matters: A quieter reporting month should not drive a reduction in your organization’s security priorities. Use external statistics as context, then focus management attention on your own exposure, overdue remediation, and ability to sustain critical services.

Recommended actions:

• Pair incident counts with affected populations, data sensitivity, service interruptions, and remediation status in leadership reporting.
• Review the systems and suppliers holding your largest patient datasets; verify retention limits and identify unnecessary copies for secure removal.
• Select one overdue high-risk finding for leadership review, with a named owner, completion date, and evidence required for closure.

Closing Thoughts

For the coming week, choose a small set of improvements your team can complete and demonstrate: validate a high-risk vendor’s response, sample monitoring records, test a clinical fallback, and review the HTI-5 implications with your EHR owner. Keep decisions and supporting evidence together so follow-up is straightforward.

Feed those results into your risk analysis and remediation plan. Review encryption, access controls, workforce training, vendor oversight, and breach-notification readiness as connected responsibilities. Clear ownership and documented follow-through make compliance easier to manage and more defensible when an incident occurs. Have a productive week.

‍