Medical services company settles with 4 states over 2023 hack of sensitive patient records

State attorneys general on Friday announced a health care services company has agreed to pay $300,000 and make sweeping changes to its security practices following a March 2023 breach exposing the data of more than 13 million people nationwide.

The case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies.

If the firm fails to make the required cybersecurity reforms, it will be required to pay the four states an additional $9.7 million, according to a press release from the office of New York Attorney General Letitia James.

James’ office launched a probe that found hackers broke into Perry Johnson’s systems by using an employee’s credentials. The company did not use multi-factor authentication to verify users, according to James’s office.

In the months following the hack, the bad actor hoovered up passwords and obtained unencrypted files storing patients’ protected health data, the press release said. While the company’s software found and recorded the hacker’s movements, it was allegedly poorly configured and did not flag the activity for the information security team.

The data theft continued unabated for two months with the firm allegedly only learning of the breach when the hackers alerted it.

The stolen records allegedly contained names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information and clinical information from medical transcription files. The files included patients’ medication names as well as diagnostic and lab test results, according to the press release.

The firm did not respond to a request for comment.

The terms of the deal require Perry Johnson to create a comprehensive information security program and incident response standards; establish multi-factor authentication, encryption and password management systems; implement yearly risk assessment programs and establish a system to properly manage the collection, use, retention and disposal of the health data it receives.