Perry Johnson Settles Patient Data Breach Case With Four States for Up to $10 Million

Perry Johnson Companies agreed to pay $300,000 and implement extensive cybersecurity reforms to settle a case brought by Connecticut, New Jersey, New York and Michigan over a 2023 breach that exposed data belonging to more than 13 million people nationwide. The case involves the Nevada-based company's medical transcription, coding and imaging businesses. An additional $9.7 million payment is contingent on failure to implement the required reforms, bringing the potential financial obligation to $10 million.

According to investigators, attackers used an employee's credentials to access systems that lacked multifactor authentication and stole unencrypted protected health information over two months without triggering security-team alerts. The settlement requires comprehensive cybersecurity and incident response programs, stronger access and data protection controls, annual risk assessments and health-data lifecycle management. The corrective measures address failures in authentication, detection and protection of sensitive patient records.