Four states settle with Perry Johnson companies over 2023 breach of 13.3 million patients' records

New York Attorney General Letitia James and the attorneys general of Connecticut, Michigan and New Jersey announced a settlement on November 6, 2026, with Perry Johnson & Associates, Inc. (PJ&A) and four affiliated companies over a 2023 data breach that exposed the personal and medical information of about 13.3 million people nationwide, including roughly 4.2 million New Yorkers.

The companies covered by the agreement are PJ&A, Perry Johnson, Inc., Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc. The New York Attorney General's office described PJ&A as an information technology company that provided coding, billing and recording services to health care organizations.

The money and how it is structured

The settlement carries a headline value of up to $10 million, but most of it is suspended. The companies will pay at least $300,000 to the four states, according to the New York release. New York receives $100,000 in penalties and costs, according to the release, and Connecticut, New Jersey and Michigan each receive $66,666, according to HIPAA Journal. If the companies fail to meet the agreement's terms, they will owe an additional $9.7 million to the states.

What the investigation found

According to the New York Attorney General's office, an attacker got into PJ&A's systems in March 2023 using the login credentials of an employee of Perry Johnson & Associates Coding. The office said PJ&A did not require multi-factor authentication for remote access, and that over the following months the attacker collected passwords and reached unencrypted files. Software run by Perry Johnson, Inc. recorded the intruder's activity, the office said, but it was not configured to alert security staff. PJ&A learned of the intrusion only when the attackers contacted the company about two months later.

HIPAA Journal reported that the network was first accessed on March 27, 2023, that files were taken between April 7 and April 19, and that the intrusion was detected on May 2, 2023. It reported that the investigation found violations of 17 provisions of the HIPAA Security Rule, along with New York General Business Law sections 899-aa and 899-bb, which cover breach notification and reasonable data safeguards.

The exposed information included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information and clinical details from transcription files, such as medication names and lab and diagnostic test results.

"Your health is your business, and companies entrusted with personal health information have a duty to rigorously protect it," James said in announcing the settlement. PJ&A did not respond to a request for comment from The Record.

Required reforms

Any Perry Johnson company that maintains protected health information must:

• maintain a comprehensive information security program and an incident response protocol;
• adopt multi-factor authentication, password management, encryption and asset management safeguards and policies;
• run annual risk assessments consistent with HIPAA; and
• keep policies governing the collection, use, retention and disposal of personal health information.

What this means for in-house counsel

The case is another example of state attorneys general enforcing HIPAA standards against a vendor rather than the health care organizations that hired it. Health systems and other covered entities should review which transcription, coding and billing vendors hold their patient data, confirm those vendors require multi-factor authentication on every remote access path and encrypt stored files, and make sure business associate agreements give the organization audit rights and prompt breach notice.

The alerting failure described by New York is a familiar gap: logging that captures an intrusion but notifies no one. Compliance teams should test whether security tools at the company and at key vendors actually route alerts to people who respond, and document those tests. New York specifically cited the unalerted logging in describing the companies' failures.

The suspended-penalty structure also matters. A small upfront payment paired with a large contingent amount gives regulators leverage over years of compliance, so companies that sign similar agreements should assign clear internal ownership for each required control and build evidence of compliance from the start.