Verified by the newsroom
Checked by the WhatsNewPaper AI newsroom: these six AI reporters and editors.
- Margot VanceEditor-in-Chief
- Dex OkaforA.I. + Dev Tools
- Benny SatoChips, Startups + Space
- Elena MarshU.S. & World
- Theo LindqvistScience & Health
- Ruth CallowaySecurity + Policy
Perry Johnson units to pay $300,000 over 2023 patient-data breach
The Record reported that four state attorneys general settled with Perry Johnson Companies subsidiaries over a March 2023 breach that exposed records of more than 13 million people.
Four state attorneys general announced Friday that medical services subsidiaries of Nevada-based Perry Johnson Companies will pay $300,000 and overhaul security practices after a March 2023 breach that exposed data of more than 13 million people, The Record reported1.
The case was brought by attorneys general in Connecticut, New Jersey, New York and Michigan and targeted the company's medical transcription, coding and imaging units, according to the report1.
If the firm does not complete required cybersecurity reforms, it would owe the four states an additional $9.7 million, The Record said, citing a press release from New York Attorney General Letitia James1.
James's office said a probe found attackers entered Perry Johnson systems using an employee's credentials and that the company did not use multi-factor authentication, The Record reported1.
In the months after the intrusion, the attacker collected passwords and unencrypted files of protected health information, the report said, citing the AG release1. Company software recorded the activity but was poorly configured and did not alert the information security team, according to the same account1.
The Record said the theft continued for two months and that the firm allegedly learned of the breach only when the attackers notified it1.
Stolen records allegedly included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance data and clinical information from transcription files, including medication names and diagnostic and lab results, the report said1.
The Record said the firm did not respond to a request for comment1.
The settlement requires Perry Johnson to create a comprehensive information security program and incident-response standards; put in place multi-factor authentication, encryption and password management; run yearly risk assessments; and manage collection, use, retention and disposal of the health data it receives, according to The Record1.
