Medical Services Firm Perry Johnson Settles with Four States Over 2023 Data Breach
Perry Johnson Companies has agreed to a $300,000 settlement and must implement significant cybersecurity reforms following a 2023 breach that exposed the protected health information of over 13 million individuals.
Perry Johnson Companies, a provider of medical transcription, coding, and imaging services, has reached a settlement with the Attorneys General of Connecticut, New Jersey, New York, and Michigan following a data breach that occurred in March 2023. The agreement mandates a $300,000 payment and requires the company to overhaul its security practices to prevent future compromises of sensitive patient data.
The breach, which exposed the protected health information of more than 13 million people nationwide, was initiated when hackers gained access to Perry Johnson's systems using stolen employee credentials. Investigations revealed that the company lacked multi-factor authentication, a critical security control, making it easier for unauthorized individuals to access its network. The attackers subsequently exfiltrated unencrypted files containing a wide range of patient data.
According to the New York Attorney General's office, the compromised data included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and detailed clinical notes from medical transcriptions. The theft continued for two months, with the company allegedly only becoming aware of the incident when the hackers themselves alerted them, highlighting significant deficiencies in their security monitoring and incident response capabilities.
As part of the settlement, Perry Johnson Companies must establish a comprehensive information security program that adheres to stringent incident response standards. This includes the mandatory implementation of multi-factor authentication, robust encryption for sensitive data, and effective password management systems.
Furthermore, the company is required to conduct annual risk assessments to proactively identify and mitigate potential vulnerabilities. The settlement also mandates the establishment of clear protocols for the collection, use, retention, and secure disposal of the health data it handles, ensuring better data lifecycle management.
Failure to comply with these cybersecurity reforms could result in an additional penalty of $9.7 million, underscoring the severity of the security lapses and the commitment required from the company to rectify them. The settlement aims to protect patient privacy and restore confidence in the company's ability to safeguard sensitive health information.
This case serves as a stark reminder of the critical importance of robust cybersecurity measures, particularly for organizations handling protected health information. The lack of basic security controls like multi-factor authentication and inadequate monitoring allowed for a prolonged and extensive data exfiltration, impacting millions of individuals.