Five related medical transcription and coding companies must improve their data security and pay at least $300,000 under a multistate settlement following a breach that affected about 4.2 million New Yorkers.
The agreement could require an additional $9.7 million if the companies fail to meet its terms, Attorney General Letitia James announced. The additional amount is conditional, rather than an immediate $10 million payment.
How hackers reached patient records
The March 2023 breach began when hackers used a coding employee's credentials to enter a remote-access system that lacked multifactor authentication, according to the attorney general's investigation.
Over the following months, the attackers collected additional passwords stored in unencrypted files and used them to reach more systems. Perry Johnson Inc. had software that recorded the activity but had not configured alerts to warn of suspicious behavior, the state said.
The companies learned of the breach when hackers contacted them about two months after the initial intrusion.
About 13.3 million people nationwide were affected. Exposed information included names, birth dates, addresses, Social Security numbers, hospital account information, diagnoses, insurance information, laboratory and test results, medications and medical transcription records, according to the attorney general.
What the companies must change
The settlement covers Perry Johnson & Associates Inc., known as PJ&A; Perry Johnson Inc.; Perry Johnson & Associates Coding Inc.; Perry Johnson & Associates Radiology Inc.; and Medical Transcription and Coding Inc.
Any of the companies that retain protected health information must maintain an information-security and incident-response program. Required safeguards include multifactor authentication, password encryption and asset management.
The companies must also conduct annual risk assessments under the Health Insurance Portability and Accountability Act and adopt policies governing the collection, use, retention and disposal of data.
James reached the agreement with three other state attorneys general. New York will receive $100,000 of the initial payments for penalties and costs. The announcement does not describe that payment as compensation distributed to affected patients.
The potential additional $9.7 million is tied to compliance with the settlement's requirements, making the security reforms central to the agreement's financial terms.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.
