Medical Associates of the Lehigh Valley
Disclosed Sep 9, 20224 years ago77,090 affectedConfirmed
Medical Associates of the Lehigh Valley, the covered entity (CE), reported that it experienced a ransomware incident that affected the protected health information (PHI) of 75,628 individuals. The PHI involved included names, addresses, dates of birth, drivers’ license and Social Security numbers, diagnoses, lab results, medications, and other treatment information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its sensitive data. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 77,090 (as reported by the organization) |
|---|---|
| Disclosed | Sep 9, 2022 |
| Happened | Jul 3, 2022 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2022 data breach report: Medical Associates of the Lehigh Valleyin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Medical Associates of the Lehigh Valley (Healthcare Provider, PA)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Sep 9, 2022 | 25 |
| HHS archivetotal | Sep 9, 2022 | 75,628 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to Medical Associates of the Lehigh Valley, the covered entity (CE), reported that it experienced a ransomware incident that affected the protected health information (PHI) of 75,628 individuals. The PHI involved included names, addresses, dat · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.