Companies that processed medical transcription, coding and billing information have agreed to security changes after a 2023 breach exposed records associated with more than 13.3 million people nationwide, including about 4.2 million New Yorkers. New York and the attorneys general of Connecticut, Michigan and New Jersey announced the settlement with the Perry Johnson group of companies on November 6.
The agreement requires an immediate payment of at least $300,000 to the four states, with New York receiving at least $100,000. An additional $9.7 million becomes payable if the companies fail to satisfy the settlement terms. Describing the matter as an agreement of up to $10 million is therefore accurate only when the conditional portion is kept distinct from the amount due at the outset.
State investigators traced the intrusion to credentials belonging to an employee of Perry Johnson & Associates Coding. The companies did not require multifactor authentication for remote access at the time, according to the attorney general. Intruders used harvested passwords to reach unencrypted files over a period of months. The organization learned of the breach after the attackers contacted it rather than through an internal alert.
The exposed information was especially sensitive. State officials said files contained names, birth dates, home addresses and Social Security numbers as well as hospital account numbers, diagnoses, insurance data, laboratory and diagnostic results and medication names. Not every affected person necessarily had every field exposed, but the combination can create risks ranging from identity theft to medical and insurance fraud.
The investigation also identified a monitoring failure. Software recorded the intruders' activity, but the system was not configured to alert security staff. Logging is useful only when an organization defines which events require attention and assigns people to respond. A record that remains unread until after a breach provides evidence for an investigation but does little to stop the intrusion while it is occurring.
Under the settlement, companies that continue to hold protected health information must strengthen access controls, retention practices and incident response. The reforms address how data are stored, who can reach them and when records should be deleted. Reducing unnecessary retention can limit the volume available to an attacker, while multifactor authentication makes a stolen password less useful on its own.
People who received a breach notice should preserve it and use the services specified in the notice. They can review credit reports, place a fraud alert or security freeze when appropriate and scrutinize medical explanations of benefits for unfamiliar care. A suspicious medical entry should be raised with the insurer and provider, because an incorrect record can affect both billing and future treatment.
Consumers should be cautious about messages that use the breach as a pretext. A legitimate notice does not require a person to disclose a password, bank PIN or one-time security code by email or text. Anyone uncertain about a communication can use the contact information in the mailed notice or an organization's verified website rather than calling a number embedded in an unsolicited message.
The settlement does not erase the exposure or guarantee that stolen information will never be misused. Its broader value will depend on whether the required controls are implemented and tested across the covered companies. For health organizations that outsource transcription or coding, the case is also a warning that vendor access remains part of the provider's risk. Sensitive data do not become less sensitive when they move to a contractor.
Primary sources: New York Attorney General settlement announcement. Reviewed November 7, 2026. Development: Settlement announced November 6, 2026.