New York AG secures up to $10m from Perry Johnson over medical breach

New York Attorney General Letitia James and the attorneys general of Connecticut, Michigan and New Jersey announced on 6 November that they had secured a settlement with five Perry Johnson companies over a March 2023 breach affecting 13.3 million people. The companies are Perry Johnson & Associates, Perry Johnson, Perry Johnson & Associates Coding, Perry Johnson & Associates Radiology, and Medical Transcription and Coding. A further $9.7m becomes payable if they fail to meet the agreement’s terms, making the potential value $10m.

For compliance teams, the settlement treats a healthcare technology provider’s identity, detection, encryption and data-lifecycle controls as one programme. Any Perry Johnson company that maintains protected health information must now operate a comprehensive information-security programme and incident-response protocol, use multi-factor authentication, password-management, encryption and asset-management safeguards, conduct annual risk assessments consistent with HIPAA, and maintain policies governing the collection, use, retention and disposal of health information, according to the New York Attorney General’s announcement.

What the investigation found

Perry Johnson & Associates provided coding, billing and recording services to healthcare organisations, including organisations in New York. The New York Office of the Attorney General found that unauthorised actors entered its systems using the credentials of a coding employee. Remote access did not require multi-factor authentication.

Over the following months, the attackers harvested passwords and accessed unencrypted files containing personal and protected health information. The exposed records included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance details, laboratory and diagnostic testing results, and medication names.

The investigation also found a monitoring failure. Perry Johnson’s software identified and recorded the attackers’ activity, but was not configured to send alerts to security personnel. The company became aware of the breach only after the attackers contacted it two months later.

The required reforms directly map to those findings:

- multi-factor identification and stronger password-management policies address credential compromise;
- encryption and asset-management safeguards address access to unencrypted files;
- a formal incident-response protocol and information-security programme address the delayed response;
- annual HIPAA-consistent risk assessments require the companies to maintain annual assessment programmes; and
- collection, use, retention and disposal policies govern what health data is kept and for how long.

The agreement applies to any Perry Johnson company maintaining protected health information, rather than only the entity whose systems were accessed. Atlas reads that scope as a signal that regulators will examine the group’s handling of health data across operating companies, not treat the incident as an isolated application or employee failure.

Part of a wider New York data-security record

The action follows a series of New York settlements involving companies that held sensitive consumer information. On 16 October, James and Connecticut Attorney General William Tong secured $2.7m from Boston Children’s Health Physicians and IT vendor XTIUM after a 2024 breach exposed records of approximately 825,000 New York residents, according to the New York AG’s announcement. The official Perry Johnson announcement also identifies James’s $18m settlement with 23andMe in July over genetic-data security failures.

The supervisory message is relevant beyond healthcare providers. A vendor that stores or processes medical information can become the enforcement target even when it is not the patient-facing organisation. Healthcare companies and other regulated businesses therefore need evidence that their processors require multi-factor authentication for remote access, encrypt sensitive files, alert on suspicious activity, test incident escalation and apply retention and disposal rules.

Here, the immediate payment is at least $300,000. The additional $9.7m is conditional, making continued compliance with the reforms the practical route to avoiding the settlement’s full $10m exposure.