The Perry Johnson data breach settlement requires the medical-services companies to pay $300,000 and adopt specified cybersecurity measures after a 2023 attack exposed records associated with more than 13.3 million people. The agreement was announced by the attorneys general of Connecticut, Michigan, New Jersey and New York.
Perry Johnson & Associates and related entities face an additional $9.7 million payment if they do not complete the required reforms, according to reporting by The Record citing New York Attorney General Letitia James's office. That amount is contingent on compliance, not an immediate $10 million payment.
The New York agreement covers Perry Johnson & Associates, Perry Johnson, Perry Johnson & Associates Coding, Perry Johnson & Associates Radiology, and Medical Transcription and Coding. New York's assurance says its investigation was conducted with the other three states and that their agreements incorporate its substantive terms, subject to local requirements.
How did the Perry Johnson 2023 breach happen?
According to New York's assurance of discontinuance, attackers entered the PJ&A network in March 2023 through its RD Web application using credentials for a PJ&A Coding employee account. The company did not require multi-factor authentication for remote access at the time, New York found.
The attorney general's findings say the attackers then examined the network, harvested passwords, raised their access privileges and moved among systems. They accessed backup databases and shared-network files containing personal and protected health information. The relevant files were not encrypted at the file level, according to the assurance.
Monitoring software had recorded malicious activity by at least March 29, 2023, but it was not configured to alert security staff, New York said. The companies learned of the attack on May 2, after the attackers contacted employees, said they had taken tens of thousands of files and demanded payment for deletion.
An investigation confirmed that database files containing patient information had been taken, although it could not determine how the attackers got the compromised credentials. PJ&A began contacting clients in July 2023. Clients notified affected people between October 31, 2023, and February 8, 2024, according to New York.
What information was exposed?
New York said later analysis found records associated with more than 13.3 million individuals, including about 4.2 million New York residents. The affected database files included names, birth dates, home addresses, medical-record and hospital-account numbers, admission diagnoses, service dates and times, Social Security numbers, insurance details, and clinical records such as lab and diagnostic results and medication names.
Until about August 2024, PJ&A and affiliates provided health IT services including transcription, coding, billing, recording and digital dictation, New York's findings say.
What changes does the settlement require?
The companies must establish a comprehensive information-security program and incident-response standards, according to The Record. They must also implement multi-factor authentication, encryption and password-management systems; conduct annual risk assessments; and control the collection, use, retention and disposal of health data they receive.
Those measures address areas implicated by New York's findings, including remote-access controls, file encryption, alerting and password practices. The Record reported that the company did not respond to its request for comment.
This story draws on original reporting from The Record.
