New York, Connecticut, New Jersey and Michigan have closed a three-year investigation into Perry Johnson & Associates, the Michigan transcription, coding and billing vendor whose March 2023 intrusion exposed the records of 13.3 million people, roughly 4.2 million of them in New York. The headline figure in the settlement is $10M. The amount actually due is $300,000, with $9.7M suspended and triggered only if the five Perry Johnson companies breach the agreement.
Two months of unnoticed access
The New York Attorney General’s findings describe the chain plainly. Attackers used a PJ&A Coding employee’s credentials, and the company did not require multi-factor authentication on remote access. Over subsequent months the intruders harvested passwords and worked through unencrypted files holding names, dates of birth, addresses, Social Security numbers, hospital account numbers, diagnoses, insurance data and transcription contents with lab results and medications. PJ&A’s software logged the activity but was not configured to alert security staff, so the vendor learned of the breach only when the attackers called in May 2023.
What hospitals must now ask vendors
The consent order binds every Perry Johnson entity touching PHI to a written security program and incident response protocol, standard MFA and password management, encryption, asset management, annual HIPAA-consistent risk assessments, and retention and disposal policies. For hospital CISOs buying transcription or coding services, that is a procurement checklist. Ask whether the business associate enforces MFA on all remote access, whether its monitoring is tuned to page someone, and whether dictation files sit encrypted at rest.
A pattern across state enforcers
New York has now extracted health-data settlements from a pediatric network, Labcorp and 23andMe in four months. Business associates are the target, and OCR is not the regulator doing it. Assume a vendor’s security failure gets litigated by a coalition of states.
