Four state AGs settle with medical transcription vendor Perry Johnson & Associates over 13.3 million-person breach
Published November 8, 2026 · Coverage November 1–7, 2026, Pacific · Medium priority
New York Attorney General Letitia James, with the attorneys general of Connecticut, Michigan and New Jersey, announced on November 6 a settlement with Perry Johnson & Associates, Inc. (PJ&A) and related companies over a March 2023 breach affecting 13.3 million people, including about 4.2 million New Yorkers. The release says hackers used a coding employee's credentials when the company did not require multi-factor authentication (MFA) for remote access. The companies will pay at least $300,000 in penalties, with an additional $9,700,000 due if they fail to meet the agreement's terms, and any Perry Johnson company that maintains protected health information (PHI) must keep an information security program and incident response protocol, multi-factor authentication, password management, encryption and asset management safeguards, annual HIPAA-consistent risk assessments, and policies on the collection, use, retention and disposal of health information. The New York Assurance of Discontinuance (AOD) makes findings against specific companies in the group, including that named entities acting as HIPAA business associates never conducted a HIPAA risk analysis and did not meet subcontractor requirements; The Assurance names PJ&A, PJ&A Coding and PJ&A Radiology as the business associates that never conducted a HIPAA risk analysis and did not meet the subcontractor requirements. The respondents neither admit nor deny the findings, and the assurance describes four of the companies (PJ&A, PJ&A Coding, PJ&A Radiology and Medical Transcription and Coding, Inc.) as insolvent and inactive as of the assurance's Effective Date.
Background
Until about August 2024, Perry Johnson & Associates, Inc. and two related companies provided health information technology services to health care organizations across the country, including medical transcription, coding and billing. According to the Assurance's findings, which the companies neither admit nor deny, Perry Johnson & Associates, Inc. and Perry Johnson, Inc. did not become aware of the March 2023 attack until May 2, 2023, when the attackers contacted their employees, and the company's clients notified affected individuals between October 31, 2023 and February 8, 2024.
Who this affects
Hospitals and health systems that use transcription, coding, billing or other vendors with remote access to PHI.
Why it matters
Inference: covered entities' vendor exposure is the lesson. Business associates with remote access and no MFA, and subcontractor chains without written assurances, were the cited failures.
Required actions
- None for organizations that are not parties to this assurance. The payment and the security and compliance obligations fall on the settling companies.
Recommended action
- Confirm that transcription, coding and billing vendors with remote access to PHI enforce multi-factor authentication, and require evidence.
- Confirm business associate agreements require downstream subcontractor agreements and that vendors perform a HIPAA risk analysis.
- Review data retention terms in vendor contracts for transcription files.
Scope and timing
- Authority status
- Settled
- Responsible owner
- Privacy; Information Security; Supply Chain and Vendor Management
- Publication date
- 2026-11-06
- Other dates
- Breach in March 2023. Assurance No. 26-039; its Effective Date is defined as the execution date, which was not established.
Not established
Connecticut, Michigan and New Jersey AG documents not retrieved. Execution date of the AOD not established.
Sources
Complete edition and supplemental material
This article in the complete report →
Executive triage, source-coverage limitations, context and forward horizons remain in the complete report.
Read the entire Enforcement Briefing report →