Four US states secure $10m from Perry Johnson companies over 13.3m-record medical data breach - https://www.lawnews.co.uk/

The settlement takes the form of an Assurance of Voluntary Compliance and requires the companies to maintain security and retention policies while paying at least $300,000 in penalties to the coalition of states. If they fail to meet these terms, they will be liable for an additional $9.7 million. The respondents neither admit nor deny the attorney general's findings.

Breach Details

The investigation found that hackers accessed Perry Johnson & Associates' systems in March 2023 using the credentials of a PJ&A Coding employee when multi-factor authentication was not required for remote access. Over the following months, the hackers harvested passwords and accessed unencrypted files containing personal and protected health information.

The company's software identified and recorded the hacker's activity but was not properly configured to alert security personnel. The activity was detectable from at least March 29, 2023, but the companies did not become aware of the attack until May 2, 2023.

Exposed Information

The breached records included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical information from medical transcription files, such as laboratory and diagnostic testing results and medication names.

Required Security Measures

Any Perry Johnson company that maintains protected health information must now implement comprehensive information security programs, multi-factor authentication, password management, encryption, and asset management safeguards. They must also run annual HIPAA-consistent risk assessments and establish policies on data collection, use, retention, and disposal.

For each "Active PJ Entity," additional requirements include penetration testing, monitoring and logging, endpoint detection and response, and obtaining a third-party assessment within 90 days of becoming active.

State Impact

The breach affected an estimated 539,669 New Jersey residents, 4.2 million New Yorkers, and 107,960 people in Connecticut. New York will receive at least $100,000, while Connecticut will receive $66,666 in penalties and costs.