By Michele Evans / NYweeklyRecord.com / Date: 11/7/2026
Category: Consumer Protection / Health Privacy / Data Security / Accountability
NEW YORK CITY, NY –
A medical transcription company entrusted with private patient information left remote access exposed without multi-factor authentication, according to New York investigators. Hackers used an employee’s credentials to enter the company’s systems, contributing to a breach that affected about 4.2 million New Yorkers and 13.3 million people nationwide.
The breach began in March 2023 at Perry Johnson & Associates, Inc., known as PJ&A. The company and four affiliates handled coding, billing, transcription and other services for health care organizations. That work placed names, medical information and other sensitive records in systems patients never chose and may not have known existed.
On November 6, New York Attorney General Letitia James announced a four-state settlement with PJ&A, Perry Johnson, Inc., Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc. Attorneys general in Connecticut, Michigan and New Jersey joined the agreement.
The settlement carries a headline value of up to $10 million, but most of that amount is conditional. The companies must pay at least $300,000 in penalties and costs to the four states. New York will receive $100,000. An additional $9.7 million becomes due only if the companies fail to comply with the agreement.
That distinction matters. A conditional penalty is leverage, not money already collected. The public should judge the agreement by whether the required security changes are completed and maintained, not by the largest number in a press release.
The attorney general’s investigation found that hackers entered PJ&A’s systems with credentials belonging to a coding employee. At the time, the company did not require multi-factor authentication for remote access. Multi-factor authentication adds a second check beyond a password, making stolen credentials harder to use.
The breach exposed a basic accountability problem in modern health care. A patient can carefully protect information shared with a doctor and still lose control of it through a contractor several steps removed from the examination room. Vendors that process records carry the same responsibility to protect privacy as the institutions that hire them.
The settlement requires a comprehensive information-security program and an incident-response protocol. It also calls for multi-factor authentication, stronger password controls, encryption, asset-management safeguards and written rules for collecting, using, retaining and disposing of personal health information.
The companies must conduct annual risk assessments consistent with the Health Insurance Portability and Accountability Act. Those reviews are supposed to identify weaknesses before an intruder does. The agreement also requires security practices to be documented rather than left to informal habits or individual employees.
The breach did not establish that every affected person suffered identity theft, fraud or medical harm. It did expose information at a scale that creates lasting risk. Medical data cannot be replaced like a compromised credit card. Records may contain diagnoses, treatments and other details that remain sensitive for a lifetime.
For New Yorkers, the size of the affected population is hard to ignore. Approximately 4.2 million state residents were caught in a failure at a company most would never recognize. The number shows how widely patient information moves through contractors and how much damage can follow when a single access point is not properly protected.
The agreement also raises questions for the hospitals, physician groups and other health care organizations that hired PJ&A. Patients deserve to know how those institutions reviewed vendor security, whether they required multi-factor authentication in their contracts, and what changed after the 2023 intrusion.
Regulators should also explain how compliance will be measured. The additional $9.7 million has force only if violations are detected and enforced. Annual risk assessments, incident plans and retention policies must be tested against actual practice.
Attorney General James called the security reforms critical to preventing another breach. The companies’ compliance, not the announcement, will determine whether that promise is met.
The case is a warning to every organization that handles health information. Basic safeguards are not optional upgrades. When millions of patients have no direct relationship with the contractor holding their records, government oversight and enforceable contracts are often the only protections they can see.
The public now has a settlement and a list of required reforms. What it still needs is proof that the companies changed their systems, that health care clients tightened vendor oversight, and that regulators will act if the same gaps return.
Sources
The Record: Medical Services Company Settles With Four States Over 2023 Hack
Leave a Reply