Draw the line around the front door: putting your digital stack in the HIPAA risk analysis

A HIPAA risk analysis that leaves out the website, the scheduling widget, the CRM, and the marketing stack is a floor plan with the front entrance left off. On October 29, 2026, HHS Office for Civil Rights announced an $800,000 settlement with Lehigh Valley Health Network, and the first potential violation it listed was the absence of an accurate and thorough risk analysis. For most health systems, the digital front door is exactly the part that document omits.

What OCR found at Lehigh Valley

The settlement, which also carries a three-year corrective action plan, stems from a 2023 ransomware attack that exposed data on 248,359 people, including sensitive photographs of radiation oncology patients. OCR's first listed potential violation was the lack of an accurate and thorough risk analysis, and it also cited late breach notifications. The risk analysis finding is not unusual. It keeps appearing as the lead failure in OCR enforcement, the smoke detector nobody installed.

The systems that usually get left out

Most risk analyses are drawn tightly around the electronic health record and the data center. The systems that handle patient information every day on the marketing and web side tend to sit outside that line entirely.

• The CMS and the website forms that collect names, conditions, and contact details.
• Scheduling and appointment-request tools.
• Chat widgets and chatbots.
• The CRM and marketing automation platform.
• Analytics, tag managers, and advertising pixels.
• The outside agency's staging and development environments, where real data sometimes lands.

Each of these touches patient information, and each is invisible to a risk analysis that was scoped to the clinical core.

How to inventory them

Bringing the front door inside the line starts with an honest inventory. For every system above, document the data flows into and out of it, the vendor behind it, whether a business associate agreement actually covers it, and who has access. The goal is a named list, not a category. A risk analysis that says marketing systems is not accurate; one that names the CMS, the CRM, the tag manager, and the agency staging server by vendor is.

Who should be in the room

This inventory cannot be built by security alone, because security does not run the marketing stack. It takes IT security, privacy, the marketing team, and the outside agency in the same conversation, each accounting for the systems they own. The agency environments in particular are easy to miss precisely because they are not on the health system's own network.

Turn findings into a plan with owners and dates

An inventory that sits in a spreadsheet is not a risk analysis. The output has to become a risk management plan: each gap assigned an owner and a date, each BAA confirmed or chased, each unnecessary data flow removed. That is the document OCR looks for, and the one Lehigh Valley was found not to have.

If you run digital for a health system, the question worth asking your security lead this week is narrow and answerable: is our web and marketing stack listed by name in the risk analysis inventory? We help health systems draw that line around the front door and keep it current, so the stack that touches patient data is accounted for before an incident makes it a finding.

Source: HHS, OCR settles ransomware investigation of Lehigh Valley Health Network.