Medical records firm pays $300,000 after breach hit 13.3 million people

Perry Johnson & Associates, a health information technology company, has agreed to pay $300,000 in penalties over a 2023 data breach. The breach exposed the personal information of 13.3 million people, including 4.2 million New Yorkers. New York Attorney General Letitia James announced the deal on Friday, along with the attorneys general of Connecticut, Michigan and New Jersey.

What happened

The state investigation found that hackers got in using the login details of one company employee. At the time, the company did not require multifactor authentication for remote access. That is a second proof of identity, such as a code sent to your phone, on top of a password.

The exposed information included dates of birth, home addresses, Social Security numbers, hospital account numbers and health details, among other things.

The states also found that the company's software recorded the break-in but was not set up to alert security staff. The company learned of the intrusion when the hackers contacted it two months later.

What the company must do

Beyond the penalty, the company agreed to stronger security rules. If it fails to carry them out, it could owe the four states another $9.7 million. New York will receive at least $100,000 of the $300,000.

• Keep a written plan for information security and for responding to a breach.
• Require multifactor authentication.
• Run a yearly risk assessment that meets health privacy laws.

The rules apply to every Perry Johnson company that handles sensitive health information. These include Perry Johnson, Inc., Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc. and Medical Transcription and Coding, Inc.

Why one password was enough

Stephen Breidenbach, a privacy and cybersecurity lawyer at the Long Island firm Moritt Hock & Hamroff, said a missing second step creates "a doorway for attackers to get into the system." With it in place, he said, an attacker who has a password would still need the employee's phone to sign in.

He said the settlement forces the companies to fix something they should have fixed anyway, and it audits them to make sure they follow through.

What to do

Patients rarely choose which companies handle their records, so this kind of breach can reach people who never dealt with the firm directly. If a company holding your health data is breached, watch for signs of identity theft. Turn on two-step sign-in for every account that offers it. The announcement does not say how affected people can check whether their information was included.

The attorney general's office has reached several similar settlements in recent months. One was $18 million from 23andMe over a cyberattack that exposed customers' genetic information.