$10M Settlement Resolves Alleged HIPAA Violations at Perry Johnson & Associates
A multistate investigation of Perry Johnson & Associates (PJ&A) over a 2023 hacking incident affecting 13.3 million individuals has been resolved with a $10 million settlement. PJ&A is a healthcare services company that provides billing, coding, transcription, and other services to HIPAA-regulated entities, and is classified as a business associate under HIPAA and is required to comply with the HIPAA Rules. The settlement also covers the affiliated companies Perry Johnson, Inc. (PJI); Perry Johnson & Associates Coding, Inc.; Perry Johnson & Associates Radiology, Inc.; and Medical Transcription and Coding, Inc. Only one of those companies, PJI, is still operating.
The settlement relates to a security incident that occurred in March 2023. Hackers accessed the PJ&A network, exfiltrated files containing patient data, and demanded a ransom payment to prevent the publication of the stolen data. While its network was compromised in March 2023, the intrusion was not detected at the time. PJ&A learned that its network was compromised in May 2023, when the hackers started contacting employees of the company and demanded a ransom.
The internal investigation determined that initial access was gained using compromised employee credentials. The hackers then moved laterally within its network by harvesting additional passwords and escalating privileges. They exfiltrated databases containing sensitive patient information, including names, dates of birth, addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical information.
An investigation was launched by the New York, Connecticut, New Jersey, and Michigan Attorneys General, led by New York Attorney General Letitia James. The multi-state investigation sought to determine how the incident occurred and whether PJ&A and the associated companies were compliant with state and federal regulations. The investigation uncovered extensive violations of the HIPAA Security Rule and violations of state laws.
The stolen credentials that allowed remote access were for an account without multifactor authentication. Data on its network was not encrypted, weak passwords had been used to secure accounts, PJ&A failed to adhere to its written security policies, and while security monitoring software was installed and logged events related to the intrusion, alerts were not configured, so the IT team was not alerted to the unauthorized activity. Further, PJI failed to conduct a reasonable investigation to identify personal information and protected health information maintained on its network. The settlement agreement states 17 specific provisions of the HIPAA Security Rule that were violated, along with violations of New York General Business Law related to cybersecurity and breach notifications.
Under the terms of the settlement, an initial $300,000 must be paid. New York will be paid $100,000, and the remaining $200,000 will be split between Connecticut, New Jersey, and Michigan. The remainder of the fine is suspended and will only need to be paid if the terms of the settlement agreement are violated. The settlement agreement includes several data security requirements:
- Maintain a comprehensive information security program and incident response protocol
- Enact multi-factor identification, password management, encryption, and asset management safeguards and policies.
- Conduct annual risk assessments consistent with HIPAA
- Maintain policies and procedures governing the collection, use, retention, and disposal of personal health information
“Your health is your business, and companies entrusted with personal health information have a duty to rigorously protect it,” said New York Attorney General James. “PJ&A failed its basic responsibility to guard patients’ data, leading to the exposure of millions of New Yorkers’ private information. As a result of our investigation, PJ&A will make critical changes to protect patients’ data to ensure a data breach like this one does not happen again.”
