Allentown, Pa.-based Lehigh Valley Health Network has started notifying patients affected by a February ransomware attack.
The health system has notified 627 individuals to date, according to a filing with HHS' Office of Civil Rights.
"We are conducting an extensive and labor-intensive analysis to determine the individuals and data involved," a hospital spokesperson told Becker's. "We continue to work through this process and will provide notices to all individuals whose information was involved as required as soon as possible."
Lehigh Valley was hacked by BlackCat, a ransomware gang with ties to Russia. The health system refused to pay ransom to the group, which subsequently posted patient data — including nude breast cancer treatment photos — to the internet. One of those patients is suing Lehigh Valley.
The spokesperson declined to say whether the 627 individuals had their medical treatment photos stolen, citing the pending litigation.