A medical transcription firm will pay $300,000 now, and up to $10 million in all, over a 2023 breach that exposed the records of about 13.3 million people.
Perry Johnson & Associates (PJ&A), a company that types up medical records for hospitals, has settled with a group of state attorneys general over a 2023 data breach. The breach touched about 13.3 million people. The deal is worth up to $10 million, but only $300,000 is due now. The other $9.7 million is suspended and must be paid only if the company breaks the terms.
PJ&A provides medical transcription, coding and billing services to hospitals and other healthcare providers. In March 2023, a hacker got into its network using a PJ&A employee's login. The hacker first got in on March 27, 2023. Between April 7 and April 19, database files with patient information were copied out.
The files included names, addresses, birth dates, Social Security numbers, diagnoses and health insurance details. Transcription files also held lab test results and medications. The hackers demanded a ransom to keep the data private. No payment was made, and the stolen data was leaked.
Investigators found the stolen login belonged to a coding employee. The account had no multifactor authentication, which is a second proof of identity on top of a password. Over the following months the hacker collected more passwords to reach more systems. The copied files were not encrypted, meaning they were not scrambled to be unreadable.
PJ&A did have security software that recorded the break-in. It was not set up to send alerts, so no one noticed. The company learned of the intrusion on May 2, 2023, when the hackers contacted employees directly. Investigators also reported these problems:
New York will receive $100,000 of the $300,000. Connecticut, New Jersey and Michigan will each receive $66,666. New York's attorney general, Letitia James, led the investigation. Four related companies are also covered by the agreement. PJ&A must now build and keep up stronger security, including:
It must also set rules for how personal health information is collected, used, kept and disposed of.
Many people never chose PJ&A. It worked behind the scenes for their providers. Ask your doctors and hospitals how they protect your data and what they require of outside vendors. Read your insurance statements for charges or services you do not recognize. The settlement terms described here do not say whether affected patients will receive any payment.
Your health records may sit with vendors you never chose, so ask providers how they protect them and read your insurance statements closely.
A compliance software CEO says AI agents already handle routine GRC tasks, and the people who check their data and set their limits will keep the value.
Read more: AI agents now do compliance busywork, so workers need new skillsPayment security firm Bluefin will use ZeroRisk software to help its merchants work through card security rules, so business owners may get clearer steps and more help.
Read more: Bluefin teams up with ZeroRisk to make card security rules easierBinance says a seller's claim to have 335 million user records for $900,000 is likely a scam, and the exchange says it found no sign of a breach.
Read more: Binance says claim of 335 million stolen user records is likely a scam
