A single stolen password, an account with no second factor, and security software that saw everything but told no one. That is how the New York Attorney General’s office describes the start of the 2023 breach at Perry Johnson & Associates (PJ&A), a medical transcription and coding vendor whose files touched 13.3 million patients across the country. On November 6, 2026, New York, Connecticut, Michigan and New Jersey announced a settlement with PJ&A and four affiliated Perry Johnson companies. The headline number is $10 million. The cash actually due is far smaller. What the companies get in return for the suspended amount is a list of security obligations, and every healthcare vendor should read that list as a checklist for itself.
TL;DR
- Four state attorneys general settled with PJ&A and four related companies over a March 2023 breach that exposed records of about 13.3 million people, including roughly 4.2 million New Yorkers.
- The companies must pay at least $300,000 in penalties and costs; a further $9.7 million is payable only if they fail to meet the agreement’s terms, so the “$10 million” figure is a ceiling, not a check already written.
- The agreement requires an information security program, an incident response protocol, multi-factor authentication, encryption, password and asset management, annual HIPAA-consistent risk assessments, and rules for retaining and disposing of health data.
What the investigation found
PJ&A provided coding, billing and dictation services to hospitals and physician groups, which meant it sat in the middle of a large volume of clinical paperwork. According to the New York Attorney General’s announcement, attackers got into the company’s systems in March 2023 using the credentials of an employee at PJ&A Coding. The company did not require multi-factor authentication for remote access at the time.
Once inside, the intruders harvested more passwords over the following months and reached unencrypted files containing personal and protected health information. The office says software run by Perry Johnson, Inc. did detect and record the activity, but it was not configured to alert security staff. PJ&A learned of the breach only when the attackers contacted the company, about two months after they first got in. Reporting by The HIPAA Journal, drawing on the company’s earlier breach disclosures, places the first access on March 27, 2023, the data theft between April 7 and April 19, and detection on May 2, 2023.
The stolen files covered more than 13.3 million people. They included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance details and clinical content from transcription files, such as lab and diagnostic results and medication names. Roughly 4.2 million of those people live in New York.
These are the findings of the attorneys general’s investigation as described in their announcement. The case ended in a negotiated agreement rather than a court judgment, and the company did not respond to a request for comment from The Record.
Reading the money correctly
Several early summaries described this as a $10 million payment. That overstates it. The New York release says the Perry Johnson companies “will pay at least $300,000 in penalties” to the coalition and will owe “an additional $9,700,000” only if they fail to meet the agreement’s terms. New York receives $100,000 of the guaranteed amount. The HIPAA Journal reports the remainder is split evenly among Connecticut, Michigan and New Jersey.
A mostly suspended penalty is not unusual in state data-security settlements, especially where regulators are more interested in fixing practices than in collecting cash. The structure gives the states leverage: the companies stay compliant or the larger sum comes due. For other vendors, the takeaway is that the obligations, not the $300,000, are the real cost of the case.
Why state attorneys general can enforce HIPAA
The HITECH Act gave state attorneys general authority to bring civil actions under HIPAA on behalf of their residents, alongside federal enforcement by the HHS Office for Civil Rights. States also apply their own data-security and breach-notification statutes. The HIPAA Journal, which reviewed the agreement, reports that it cites 17 provisions of the HIPAA Security Rule plus two New York statutes: General Business Law section 899-aa on breach notification and section 899-bb, which requires reasonable safeguards. It also reports that, while PJ&A ran general risk assessments, the states found it had not done a HIPAA risk analysis and had given subcontractors technical access to systems holding health data without contracts requiring them to protect it.
Federal regulators have been pressing the same point. The HHS Office for Civil Rights has spent the past two years telling covered entities and business associates that the risk analysis is the foundation, and its updated HIPAA security guidance treats risk management as the core of compliance rather than a paperwork step. Smaller cases follow the same pattern, such as the OCR settlement with a Syracuse surgery center after a ransomware attack.
The security commitments, item by item
The New York announcement lists what any Perry Johnson company that keeps protected health information must now do. Each item maps directly to a failure in the investigation.
- A comprehensive information security program and an incident response protocol. The breach ran for weeks before anyone inside noticed. A program with named owners, and a response plan that someone actually tests, is the baseline.
- Multi-factor authentication. The intrusion began with one employee’s credentials on an account that did not require a second factor. Credential attacks on employees remain one of the most common entry points, as the string of employee credential attacks on large companies has shown.
- Password management. The attackers harvested additional passwords after they got in. Credential vaulting, rotation and limits on stored passwords make that second step harder.
- Encryption. The files taken were unencrypted. Encryption at rest would not have stopped an attacker holding valid credentials in every case, but it narrows what a single compromised account can read.
- Asset management. You cannot alert on systems you do not know you have. An accurate inventory of servers, endpoints and data stores is the precondition for monitoring them.
- Annual risk assessments consistent with HIPAA. This is the gap the states identified: general assessments are not the same as a Security Rule risk analysis.
- Collection, use, retention and disposal policies. Transcription vendors accumulate years of clinical files. Data that has been deleted cannot be stolen.
The announcement does not say that alerting configuration is a separate term, but it is the lesson that stands out most. The logging tool worked. It recorded the attacker. No one was told.
What this means for healthcare vendors and their clients
PJ&A was a vendor, and its clients were hospitals and medical groups that trusted it with patient files. That puts pressure on both sides of the relationship.
- Vendors handling health data should check that every remote access path requires a second factor, including service accounts and contractor logins. They should also confirm that security tools send alerts to a monitored queue rather than just writing logs.
- Covered entities should ask vendors for evidence of a HIPAA risk analysis, not just a SOC report or a questionnaire answer, and confirm how the vendor manages its own subcontractors.
- Legal and procurement teams should check what their contracts actually cover. Indemnities and limitation-of-liability clauses often do less than expected, which is why tech contracts rarely shield a company from breach fallout on their own.
- Privacy teams should map notification duties in advance. A breach at a vendor of this size triggers obligations under HIPAA and under state laws, including the Connecticut data breach notification law and New York’s statute.
The New York office has been busy on this front. Its announcement lists recent data-security settlements with a pediatric health network and IT company, with Labcorp, and with 23andMe. The office has also gone after smaller firms, such as the Wojeski & Company settlement. Company size has not protected anyone.
Frequently asked questions
Did PJ&A pay $10 million?
No. The guaranteed payment is at least $300,000. The other $9.7 million becomes payable only if the companies fail to meet the agreement’s terms.
Which companies are bound by the agreement?
Perry Johnson & Associates, Inc., Perry Johnson, Inc., Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc. The security terms apply to any of them that maintains protected health information.
Why did the breach go unnoticed for two months?
According to the New York Attorney General, the monitoring software recorded the intruder’s activity but was not set up to alert security personnel. The company found out when the attackers made contact.
Does this settlement affect private lawsuits over the breach?
It resolves the four states’ investigation. Patient class actions are separate proceedings, and this agreement does not decide them.
The alarm nobody wired up
Most breach stories hinge on an attack nobody could see. This one is different. The intrusion was recorded as it happened, and the files were sitting unencrypted behind a login with no second factor. Those are ordinary controls, and ordinary controls can be audited. Any vendor that holds patient records can check this week whether MFA covers every remote login and whether its alerts reach a person who is on duty. The four states have now written those checks into an agreement. Every other healthcare vendor can treat them as a list of questions it should be able to answer.
