Perry Johnson healthcare data breach: $10 mn settlement over 13.3 mn patients - Beinsure

The settlement covers five Perry Johnson companies that provided healthcare organizations with medical transcription, coding, billing, recording and digital dictation services. The March 2023 cyberattack exposed database records associated with more than 13.3 million individuals, including approximately 4.2 million New Yorkers.

The compromised information included names, dates of birth, home addresses, Social Security numbers, medical record numbers, hospital account numbers and insurance details. Clinical records also contained admission diagnoses, service dates, laboratory and diagnostic test results, medication names, treatment facilities and healthcare provider information.

Security Failures Identified

Investigators found that hackers accessed unencrypted database backups and shared network files containing personal information and protected health information (PHI). The attackers entered PJ&A's network through the RD Web remote access application using credentials belonging to a PJ&A Coding employee. At the time, the company did not require multifactor authentication (MFA) for remote access.

The investigation revealed multiple security failures, including weak password controls. In May 2022, a PJ&A administrator created nine accounts using nearly identical passwords and distributed all nine credentials in a single email to several managers, who subsequently forwarded them to employees. The passwords remained unchanged when the breach occurred approximately 10 months later, despite an internal policy requiring changes every 90 days.

Although security monitoring software was capable of detecting suspicious activity, it was not properly configured to notify security personnel. The problem had been raised more than a year earlier but was never addressed.

Settlement Terms

Under the agreement, the companies must initially pay $300,000 in penalties and costs. An additional $9.7 million is suspended but becomes payable if they breach the settlement or if their representations about their finances prove materially inaccurate.

New York's allocated share of the settlement is approximately $3.33 million, including $100,002 payable immediately and the remainder suspended.

Mandatory Cybersecurity Reforms

The settlement requires extensive changes to information security, incident response, access controls and the handling of sensitive health records. Active Perry Johnson entities handling personal or protected health information must maintain documented security programs including annual risk assessments and appropriate safeguards.