Archive: FlyD/Unsplash
A 2023 medical-data breach that exposed millions of New Yorkers’ information has led to a four-state settlement requiring security fixes and $300,000 in penalties. Another $9.7 million remains suspended unless the Perry Johnson companies break the agreement or gave materially inaccurate financial information.
New York Attorney General Letitia James and the attorneys general of Connecticut, Michigan and New Jersey announced the settlement Friday, according to the announcement. The March 2023 breach affected 13.3 million people, including about 4.2 million New Yorkers. New York will receive at least $100,000.
What the attorney general found
The attorney general’s office said hackers got into the systems of Perry Johnson & Associates, a company that handled coding, billing and recording for health care organizations, using a coding employee’s login. The company did not require multi-factor authentication for remote access at the time, the office said. Over the following months, hackers took passwords and opened unencrypted files.
The office said monitoring software recorded the hacker’s activity but was not set up to alert security staff, and the company learned of the breach only when the hackers contacted it two months later. The files held names, birth dates, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance details and clinical information such as lab results and medication names.
What the companies must do
Any Perry Johnson company that holds protected health information must keep a security program and an incident response plan, use multi-factor authentication, password management and encryption, run yearly risk assessments under federal health privacy rules, and follow rules for how health information is kept and disposed of, the announcement said.
Under the signed agreement, $300,000 is due within 14 days of the agreement’s effective date. The other $9.7 million is suspended. It becomes due immediately if the attorney general finds the companies’ statements about their finances were not materially accurate, or if they violate the agreement. The agreement says the suspension rests on the companies’ statements that they cannot pay the full amount because certain of them are insolvent. It lists four of the companies, Perry Johnson & Associates, its Coding and Radiology units, and Medical Transcription and Coding, as insolvent and inactive. The companies neither admit nor deny the attorney general’s findings.
JBizNews Desk | New York
© JBizNews.com. All rights reserved. Unauthorized reproduction or redistribution is strictly prohibited.
