The attorneys general of New York, Connecticut, Michigan and New Jersey have settled with medical transcription and coding provider Perry Johnson & Associates and four related companies over a 2023 breach that exposed health data of about 13.3 million people, the New York attorney general's office announced Friday. The case shows state regulators holding a health care vendor, not only the hospitals it serves, to specific security controls.
What Happened
The settlement covers Perry Johnson & Associates, Perry Johnson Inc., Perry Johnson & Associates Coding, Perry Johnson & Associates Radiology and Medical Transcription and Coding. The states value it at up to $10 million, but the companies must pay only at least $300,000 in penalties now, with at least $100,000 going to New York. A further $9.7 million becomes payable only if they fail to meet the agreement's terms. The company did not respond to a request for comment, The Record reported.
According to the states, hackers broke in during March 2023 using the login of an employee at the coding unit, because the firm did not require multifactor authentication, a second sign-in step beyond a password, for remote access. Over the following months they harvested passwords and opened unencrypted files. Monitoring software recorded the activity but was not set up to alert security staff, and the firm learned of the intrusion only when the hackers contacted it about two months later.
Exposed data included names, birth dates, addresses, Social Security numbers, hospital account numbers, diagnoses, insurance details, lab results and medication names. About 4.2 million New Yorkers were affected, and New Jersey's attorney general put that state's count at about 539,669 residents.
"PJ&A failed its basic responsibility to guard patients' data," New York Attorney General Letitia James said in a statement.
Why It Matters
The firm provided coding, billing and transcription services to health care organizations across the country, so one vendor's weak login controls exposed patients of many providers at once. For hospital boards and executives, the lesson is that patient data held by contractors needs the same scrutiny as data held in-house: confirm that vendors require multifactor sign-in, that their logging actually alerts someone and that stored records are encrypted.
The required reforms read like a checklist: a comprehensive security program and incident response plan, multifactor authentication, password management, encryption and asset tracking, annual risk assessments consistent with the federal health privacy law known as HIPAA, and policies for keeping and disposing of health data.
What to Watch
The $9.7 million held in reserve gives the states leverage while the agreement is in force, so watch for any enforcement action alleging the companies missed the agreed controls. Also watch whether other states pursue similar vendor-focused settlements built around specific failures such as missing multifactor authentication.
