The medical transcription company behind a 2023 breach that exposed records on 13.3 million people will pay $300,000 to four states, not the $10 million in the settlement's headline. The other $9.7 million comes due only if the Perry Johnson companies break the agreement, according to the New York attorney general's announcement on Friday, Nov. 6.
New York, Connecticut, Michigan and New Jersey reached the settlement with Perry Johnson & Associates and four related companies. PJ&A did transcription and billing work for health care providers around the country. About 4.2 million of the people affected live in New York and roughly 108,000 in Connecticut, the Connecticut attorney general's office said.
How the hackers got in
The states' investigation found that in March 2023 the intruders logged in with the credentials of an employee at PJ&A's coding unit. Remote access did not require multi-factor authentication. Over the following months the hackers collected more passwords and opened unencrypted files.
The breach went unnoticed for two months.
A Perry Johnson security tool recorded the activity but was not set up to alert anyone, and the company learned of the intrusion only when the hackers contacted it, according to both releases. Social Security numbers were in the stolen files. So were names and birth dates, along with insurance details and diagnoses, and some records carried transcribed lab and diagnostic test results and medication names.
What the companies must do now
Any Perry Johnson company that keeps patients' health information has to run a full information security program with an incident response plan. Multi-factor authentication and encryption are now required. The companies also have to assess their risks every year in line with HIPAA and set rules for how long patient data is kept and how it is destroyed.
New York gets $100,000 of the guaranteed $300,000 and Connecticut $66,666, while neither release gives the shares for Michigan and New Jersey. New York has brought several similar health data cases this year. Its office lists an $18 million settlement in July with 23andMe over customers' genetic data and $2.3 million in September from Labcorp after a breach at the lab company, plus $2.7 million in October from a pediatric health network and an IT company.
