A settlement over the Perry Johnson companies’ 2023 medical data breach puts security practices, as well as financial penalties, under scrutiny. New York and three other states announced the agreement on November 6, following an incident affecting more than 13.3 million people, including about 4.2 million New Yorkers.
The financial distinction matters: the companies must pay $300,000, while another $9.7 million is suspended. Under the signed settlement, that balance becomes payable if financial representations prove materially inaccurate or the agreement is violated. The headline figure is therefore not an immediate $10 million payment.
According to the New York Attorney General’s announcement, attackers entered PJ&A’s systems in March 2023 using an employee’s credentials. Remote access did not require multi-factor authentication. The attackers subsequently harvested passwords and reached unencrypted files containing personal and medical information.
The investigation also found a gap between recording an intrusion and responding to it. Monitoring software captured malicious activity but was not correctly configured to alert security staff. The companies learned of the breach when the attackers contacted them two months later, the attorney general said.
Exposed records included identifiers such as Social Security numbers, alongside diagnoses, insurance details and clinical information. PJ&A had provided healthcare organizations with services including medical coding, billing and transcription.
Controls must work beyond the policy document
The settlement records further findings about credential handling: nine accounts received almost identical passwords, which were distributed together by email. Investigators could not determine how the attackers obtained the credentials used for initial access. The companies neither admitted nor denied the investigation’s findings.
For covered active entities, the agreement requires MFA, encryption, access restrictions, network segmentation and annual penetration testing. Centralized logging must be accompanied by automated alerts to security personnel. Entities that are inactive must return or destroy retained personal and health information when business and legal retention requirements end.
For healthcare security teams, the practical lesson is to test the path from detection to response. A recorded event offers little protection if nobody receives it. Vendor reviews should examine how access controls and alerting operate in practice, alongside the written policies describing them.
