Four state attorneys general worked together to reach a settlement that could be as high as $10 million over a data breach experienced at Perry Johnson & Associates, along with four other associated companies.

 

What happened

On November 6th, 2026, New York Attorney General (AG) Letitia James filed a press release about a settlement reached in response to a 2023 data breach.

The breach impacted systems from Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology Inc., and Medical Transcription and Coding, Inc., which are collectively known as the Perry Johnson companies.

Under the terms of the settlement, the companies must “maintain robust security and retention policies and practices” and pay $300,000 in penalties to the coalition of attorneys general. If they fail to meet the terms, they may be liable to pay up to an additional $9.7 million to the states.

 

The backstory

The March 2023 breach impacted approximately 13.3 million individuals, with most victims hailing from Connecticut, New Jersey, New York, and Michigan.

Through an investigation, the coalition determined that in March of 2023, hackers accessed PJ&A’s systems using the credentials of a PJ&A Coding employee. Before the incident, PJ&A did not require multi-factor authentication (MFA) when remotely accessing network systems. Over a period of several months, hackers managed to harvest passwords and access unencrypted files that contained personal and protected health information.

Despite determining that PJI’s software identified and recorded the activity, it was not set up to provide security alerts. PJI learned of the event when the hackers contacted them two weeks later. The malicious group responsible has not been publicly identified.

 

In the know

The incident resulted in a trove of data being accessed, including names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical information from medical files (including medical testing results and medication names). As part of the settlement agreement, PJ&A companies have agreed to:

  • Maintain a comprehensive information security program and response protocol,
  • Enact standard MFA, password management, encryption, and asset management safeguards and policies,
  • Implement annual risk assessments
  • Maintain policies and procedures governing the collection, use, retention, and disposal of personal health information.

 

What was said

AG James said, “PJ&A failed its basic responsibility to guard patients’ data, leading to the exposure of millions of New Yorkers’ private information…”

Connecticut’s AG, William Tong, shared the same sentiments, adding, “This settlement includes strong new protections to ensure personal information is secure going forward. Companies have a responsibility to safeguard sensitive information, and we will not hesitate to hold them accountable when they fail to do so.”

 

The big picture

The incident is another example of organizations being held accountable by the government for data breaches. AG James noted previous efforts made by her office, including a $2.3 million settlement from Labcorp and a $1.7 million settlement from Illuminate Education.

The Department of Health and Human Services has also been cracking down on proper responses to cybersecurity incidents. In October, the HHS agreed to a settlement with Lehigh Valley Health Network over the handling of a ransomware attack, resulting in an $800,000 payout. In September, the HHS secured a $700,000 payout from a phishing attack against Ambry Genetics. These cases, among others, show that healthcare organizations can face severe financial repercussions, and those consequences are no longer only from class action suits; they are more frequently coming from the HHS or attorneys general.

 

FAQs

Do data breaches always result in investigations by attorneys general or the HHS?

No, although the HHS and various states appear to be investigating breaches more regularly. In general, governing bodies investigate healthcare organizations only if they believe the organization may not have been HIPAA compliant. In contrast, many class action lawsuits are filed if the breach was believed to be preventable or if it adversely affected victims.

 

How likely is it that PJ&A will pay the additional funds?

It’s not clear if PJ&A will have to pay the rest of the settlement to the coalition of attorneys general. If they can meet all of the new requirements, they will not have to, and so they have a great incentive to improve security. With knowledge of the specific areas of improvement, it seems unlikely they will continue to have these security issues, but the potential fine keeps the option open if the coalition is displeased with PJ&A’s progress.