Perry Johnson settles PJ&A breach with four states, up to $10M

Four state attorneys general — New York, Connecticut, New Jersey and Michigan — reached a settlement with five Perry Johnson entities over the March 2023 breach of medical-transcription subsidiary PJ&A that exposed data on 13.3 million people. The headline figure is "up to $10 million," but only $300,000 is payable now; the remaining $9.7 million is suspended and comes due only if the companies fail to deliver the required security reforms.

The primary source is Connecticut Attorney General William Tong's settlement announcement. New York AG Letitia James framed the deal as up to $10 million and critical reforms; it was also reported by The Record and DataBreaches.net.

What happened

The underlying breach dates to March 2023. Per the states' investigation, attackers logged in with a Perry Johnson employee's credentials — the company did not use multi-factor authentication — and exfiltrated data for roughly two months. The company reportedly learned of the intrusion only when the attackers themselves alerted it.

Exposed data included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical details pulled from transcription files (medication names, diagnostic and lab results).

The breach hit 13.3 million individuals nationwide, including approximately 4.2 million New Yorkers. Connecticut counted 107,960 affected residents; its share of the upfront penalty is $66,666.

The settlement terms

• $300,000 in penalties paid now, split among the four states.
• $9.7 million suspended — payable if the companies (or their successors) violate the agreement, or if the New York AG finds the financial representations behind the suspension were inaccurate.
• Required reforms: a written information-security program, an incident-response plan, tighter access controls, encryption of personal data, annual risk assessments, and health-data lifecycle controls.

What to do today

If you handle PHI or rely on transcription, coding, or imaging vendors, the lesson here is a single missing control:

1. Enforce MFA on all remote and privileged access. Its absence is what the investigators flagged first.
2. Inventory your transcription/coding/imaging vendors and confirm their MFA, logging, and retention posture in writing.
3. Alert on anomalous bulk reads and egress. PJ&A's theft ran for about two months undetected.
4. Minimize PHI at rest. Transcription pipelines accumulate sensitive free-text; shorten retention and purge on schedule.
5. If you were a PJ&A client, re-confirm your 2023 breach notification obligations were met and that affected patients were offered monitoring.

Context

The structure here — a small upfront penalty with a much larger suspended amount tied to compliance — is the enforcement lever state AGs increasingly use after healthcare breaches where a basic control was absent. It turns the settlement into a multi-year obligation rather than a one-time fine. For a vendor whose entire product is other organizations' sensitive records, the absence of MFA in 2023 is the kind of gap that now carries a standing price tag.