Healthcare technology company Perry Johnson & Associates (PJ&A) and its affiliated companies have agreed to a settlement worth up to $10 million after hackers exposed the sensitive medical records of 13.3 million patients, according to New York Attorney General Letitia James and officials from Connecticut, Michigan and New Jersey.
The companies will pay the coalition at least $300,000 in penalties and strengthen their data security and retention policies. They could face an additional $9.7 million in payments to the states if they fail to meet the settlement terms. New York will receive at least $100,000.
How the breach occurred
Hackers accessed the systems in March 2023 using the credentials of a PJ&A Coding employee, and the company did not require multi-factor authentication for remote access. Over the following months, the intruders harvested passwords and accessed unencrypted files containing names, dates of birth, Social Security numbers, diagnoses, lab results, medications and insurance details.
The company’s software recorded the hackers’ activity but was not set up to alert security staff. PJ&A learned of the breach in May 2023, when the hackers contacted employees and demanded payment to delete the files.
Required security changes
Under the agreement, the companies must use multi-factor authentication, encryption, annual HIPAA risk assessments and strict data retention policies.
“Your health is your business, and companies entrusted with personal health information have a duty to rigorously protect it,” James said. “PJ&A failed its basic responsibility to guard patients’ data, leading to the exposure of millions of New Yorkers’ private information.”
James added that the investigation will require PJ&A to make critical changes to protect patients’ data and help prevent a similar breach.
The breach affected more than 13.3 million people, including approximately 4.2 million New York residents.
