Medical records of 4.2 million New Yorkers exposed as four states reach $10 million settlement

New York Attorney General Letitia James announced on November 6 a settlement with the attorneys general of Connecticut, Michigan and New Jersey, closing a joint investigation into a March 2023 data breach at Perry Johnson & Associates (PJ&A) and four affiliated companies. The exposed database files held records associated with more than 13.3 million people, including about 4.2 million New York residents. The headline settlement is $10 million, but the companies must pay only $300,000 in penalties and costs within 14 days — New York will receive $100,000 — while the remaining $9.7 million is suspended and becomes payable only if the companies breach the agreement or their financial representations prove materially inaccurate.

Hackers entered with an employee's credentials; remote access had no multi-factor authentication

The investigation found that in March 2023, hackers accessed PJ&A's systems using the credentials of an employee in its coding division, and the remote access in question had no multi-factor authentication. The leaked files contained names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information and clinical information from medical transcription files, such as laboratory and diagnostic test results and medication names. PJ&A provided coding, billing and transcription IT services to health care organisations across the country. Prosecutors noted the companies were insolvent and inactive as of the agreement's effective date, which is the backdrop to most of the money being suspended.

Security reforms required; no claim form for victims

The settlement also requires the companies to maintain robust information-security and data-retention policies and practices, including stronger access controls, incident response and handling of sensitive health records. Notably, there is no claim form, eligibility portal or monitoring benefit attached to this settlement: it is a state enforcement action, not a compensation scheme for victims, while separate private lawsuits were consolidated into federal multidistrict litigation in January 2024. James has taken several health-data enforcement actions this year: $2.7 million from a pediatric health network and IT company in October, and $2.3 million plus reforms from Labcorp in September.

(Sources: New York Attorney General; Recording Law; BeInSure.)