Four States Secure $300,000 Settlement and Cybersecurity Reforms from Perry Johnson

Connecticut, New Jersey, New York, and Michigan have reached a settlement with Perry Johnson Companies over a March 2023 breach that exposed sensitive information belonging to more than 13 million people nationwide. The case involved the company’s medical transcription, coding, and imaging subsidiaries. Under the agreement, Perry Johnson must pay $300,000 and make broad changes to its information security practices. If it fails to complete the required reforms, the four states can require an additional $9.7 million payment. The settlement makes the consequences of weak data protection concrete for organizations that provide services involving health information.

According to findings described by the New York Attorney General’s Office, hackers accessed Perry Johnson’s systems using an employee’s credentials. The company did not require multifactor authentication to verify users. After gaining access, the attacker reportedly collected passwords and obtained unencrypted files containing protected health information. Although the company’s software recorded the hacker’s activity, it was allegedly configured poorly and did not alert the information security team. The activity continued for two months, and the company allegedly learned of the breach only after the hackers notified it.

The exposed records reportedly included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical details from medical transcription files. Those clinical details included medication names and diagnostic and laboratory test results. The breadth and sensitivity of the information underscore why government buyers and prime contractors should assess not only whether a supplier has security tools, but whether those tools are configured, monitored, and supported by working escalation and response procedures.

For procurement teams, the settlement provides specific subjects for supplier due diligence: multifactor authentication, encryption, password management, incident response, recurring risk assessments, and controls over the collection, use, retention, and disposal of health data. These requirements apply to Perry Johnson under its settlement; they do not automatically impose the same obligations on every contractor. However, agencies and contractors can use the incident as a practical risk example when evaluating vendors that handle patient or other sensitive information, including through subcontracted services. Companies serving healthcare clients should also account for the operational expense of sustained corrective measures and the potential financial exposure associated with a breach.

• Settlement parties: Connecticut, New Jersey, New York, and Michigan reached an agreement with Perry Johnson Companies over the 2023 incident.
• Payment: Perry Johnson agreed to pay $300,000 under the settlement.
• Additional exposure: Failure to complete the required cybersecurity reforms could trigger an additional $9.7 million payment to the four states.
• Scale of incident: The March 2023 breach exposed records belonging to more than 13 million people nationwide.
• Access weakness: The investigation found that an employee’s credentials were used and that multifactor authentication was not in place to verify users.
• Detection and response concerns: The company’s software reportedly recorded the hacker’s movements but was poorly configured to alert the information security team; the activity continued for two months.
• Data involved: Exposed information reportedly included identity, contact, financial or account, insurance, diagnosis, medication, and laboratory or clinical details.
• Required security program: Perry Johnson must establish a comprehensive information security program and incident-response standards, along with multifactor authentication, encryption, and password management systems.
• Ongoing controls: The agreement calls for yearly risk assessments and a system to manage health data collection, use, retention, and disposal.
• Procurement application: Buyers can incorporate these safeguards into supplier diligence and risk reviews, while recognizing that the settlement’s specific obligations apply to Perry Johnson rather than automatically to all contractors.