Health IT vendor Perry Johnson & Associates and four affiliated companies have reached a settlement of up to $10 million with four state attorneys general following a 2023 data breach that exposed information belonging to more than 13.3 million people.
New York Attorney General Letitia James announced the settlement Nov. 6 alongside attorneys general from Connecticut, Michigan and New Jersey. The agreement requires the companies to strengthen their cybersecurity practices and pay at least $300,000 in penalties and costs. An additional $9.7 million would be owed if the companies fail to comply with the settlement’s terms.
Perry Johnson & Associates provided services including medical coding, billing and recording to healthcare organizations nationwide. Approximately 4.2 million New Yorkers were among those affected by the breach.
According to the New York attorney general’s investigation, hackers gained access to the company’s systems in March 2023 using credentials belonging to an employee of Perry Johnson & Associates Coding.
At the time, the company did not require multifactor authentication for remote access to its systems. Over the following months, attackers harvested passwords and accessed unencrypted files containing personal and protected health information.
Investigators also found that software used by affiliate Perry Johnson Inc. recorded the attackers’ activity but was not properly configured to alert security personnel. The company did not discover the breach until hackers contacted it two months after the initial intrusion.
Compromised information included patient names, dates of birth, addresses, Social Security numbers, hospital account numbers, diagnoses and insurance information. Medical transcription files also contained clinical information, including laboratory and diagnostic test results and medication names.
The breach affected several major health systems, including Chicago-based Cook County Health and New Hyde Park, N.Y.-based Northwell Health.
Up to 1.2 million Cook County Health patients may have had information compromised, Becker’s previously reported. The health system ended its relationship with PJ&A after learning of the incident.
Northwell Health also faced a proposed class-action lawsuit related to the breach, which reportedly affected 3.9 million people associated with the health system. Northwell previously told Becker’s that its own systems were not affected by the attack.
The incident also drew federal scrutiny. In November 2023, Cook County Health received a grand jury subpoena from federal prosecutors, including the Justice Department’s fraud section, seeking records related to the breach, such as communications with PJ&A and information about affected patients, NPR affiliate WBEZ reported in June 2024.
Under the settlement, Perry Johnson companies that maintain protected health information must implement several cybersecurity reforms, including comprehensive information security programs, incident response protocols, multifactor authentication, encryption and password management safeguards.
The companies must also conduct annual risk assessments consistent with HIPAA and establish policies governing the collection, use, retention and disposal of personal health information.
New York will receive $100,000 in penalties and costs under the agreement.
