Perry Johnson & Associates, Inc. and four related organizations have consented to a multistate settlement costing about $10 million after an investigation confirmed several HIPAA Security Rule and state law violations.
The settlement involves Perry Johnson & Associates, Inc. (PJ&A), Medical Transcription and Coding, Inc., Perry Johnson, Inc., Perry Johnson & Associates Radiology, Inc., and Perry Johnson & Associates Coding, Inc.
Of the $10 million settlement, PJ&A must pay $300,000 in penalties. The outstanding $9.7 million may become payable to the other states in case the PJ&A companies do not meet the terms of the settlement.
New York will get $100,000 of the $300,000 penalty. New Jersey, Connecticut, and Michigan will each get $66,666.
2023 Cybersecurity Incident
PJ&A encountered a cybersecurity incident in March 2023. A threat actor breached the company’s system using the details of a PJ&A employee and accessed areas of the system that contain the electronic protected health information (ePHI) of around 13.3 million people.
The forensic investigation confirmed that the system’s first access was on March 27, 2023. From April 7 to April 19, 2023, database files comprising patient data were extracted.
The breached information included names, addresses, birth dates, diagnoses, medical insurance details, information included in transcription files, and Social Security numbers. The transcription files contained laboratory test results and medicines.
The attack was noticed on May 2, 2023, after the individuals behind the attack contacted PJ&A employees demanding a ransom payment to avoid exposure of the stolen information. The stolen information was eventually exposed because PJ&A did not pay the ransom.
Multistate Investigation Findings
A group of state attorneys general conducted an investigation to find out if the data breach was due to failures to follow national and state regulations. New York Attorney General Letitia James headed the investigation with the participation of New Jersey Attorney General Jennifer Davenport, Michigan Attorney General Dana Nessel, and Connecticut Attorney General William Tong.
The investigation confirmed that the threat actor used a coding employees’s stolen credentials to access an account without active multifactor authentication. After getting access to PJ&A systems, the attacker collected passwords to access other resources and extract unencrypted files with personal data and protected health information (PHI).
PJ&A’s security software program had a record of the unauthorized activity. The software wasn’t set to produce alerts, and the attack was not discovered until the people behind the attack made it known about two months after the preliminary compromise.
HIPAA Security Law Findings
The multistate investigation determined that PJ&A completed a general risk analysis; however, it did not carry out a HIPAA risk analysis. The investigation additionally confirmed PJ&A’s failure to implement or assess its technical, administrative, or physical security measures in line with the HIPAA Security Law.
The investigation determined failures concerning subcontractors that had specialized access to systems that contain ePHI. The subcontractors weren’t contractually expected to ensure the privacy of the ePHI or carry out acceptable safety measures to protect it.
The PJ&A companies violated 17 HIPAA Security Law provisions and New York regulations GBL §899.
As per the settlement contract, PJ&A needs to follow and maintain data security guidelines and protocols. The needed safety measures include a complete data security program and an incident response plan. The settlement also requires data encryption, multifactor authentication, password control, and asset management safety measures and guidelines.