Company that failed to protect medical data agrees to $300,000 penalty, security reforms in settlement with New York and other states
New York State Attorney General Letitia James announced a settlement with a Nevada-based health information technology company that will net the state at least $100,000. Credit: Getty Images/Michael M. Santiago
A health information technology company has agreed to tighten data security and pay hundreds of thousands of dollars to states with residents impacted by a 2023 breach of patient data, including New York.
New York Attorney General Letitia James on Friday announced that — with attorneys general from Connecticut, Michigan and New Jersey — her office had secured an agreement from Perry Johnson & Associates, Inc. and associated companies to pay $300,000 in penalties and implement stronger data handling and security policies. If they fail to do so, the companies are liable to pay an additional $9.7 million to the four states. The companies will pay at least $100,000 to New York as part of the agreement.
"Your health is your business, and companies entrusted with personal health information have a duty to rigorously protect it," James said in a news release. "PJ&A failed its basic responsibility to guard patients’ data, leading to the exposure of millions of New Yorkers’ private information. As a result of our investigation, PJ&A will make critical changes to protect patients’ data to ensure a data breach like this one does not happen again."
The attorney general office investigation found that hackers used credentials from a Perry Johnson & Associates, Inc. employee to access the company's systems. The company, at the time, did not require multifactor authentication for remote access. The cybercriminals collected passwords and accessed files with the personal information of 13.3 million individuals, including 4.2 million New York residents, according to a news release.
Leaked information included dates of birth, home addresses, Social Security numbers, hospital account numbers and health details, among other things, James' office said.
The states' investigation found that the company's software recorded the breach but was not set up to alert security. Perry Johnson & Associates learned of the intrusion when the hackers contacted the company two months later, according to a news release.
All Perry Johnson companies that handle sensitive health information are now required to adopt more comprehensive data handling and security policies. In addition to Perry Johnson & Associates, Inc., those companies include Perry Johnson, Inc., Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc. and Medical Transcription and Coding, Inc.
According to the state, the companies are now required to take measures that include maintaining a protocol for information security and incident response, implementing multifactor identification and conducting annual risk assessment programs that comply with health privacy laws.
James' office has secured several similar settlements from companies for breaches that compromise consumer data in recent months, including $18 million from 23andMe for a cyberattack that exposed customers' genetic information.
The lack of multifactor authentication creates "a doorway for attackers to get into the system," said Stephen Breidenbach, co-chair of the privacy, cybersecurity and technology practice group at Garden City-based law firm Moritt Hock & Hamroff. "If you have multifactor authentification in place, even if the attacker got that password, they would still need possession of the individual's phone to allow for the sign-in to occur."
The settlement is ultimately forcing the affected companies "to address something that they should have addressed otherwise," and auditing them to make sure "they're doing what they're supposed to be doing," he said.
Brianne Ledda covers personal finance and affordability for Newsday. She previously covered Southold and Greenport for The Suffolk Times and is a graduate of Stony Brook University.
