Five Perry Johnson companies have agreed to pay $10 million in penalties and costs to Connecticut, Michigan and New Jersey over a 2023 cyberattack, Attorney General William Tong announced Friday, Nov. 6, but only $300,000 is due now. The remaining $9.7 million is suspended. It becomes payable if the attorney general finds that the companies' statements about their finances were not materially accurate, or if the companies or their successors violate the agreement.
The settlement, announced by Tong's office, covers Perry Johnson & Associates (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Perry Johnson & Associates Radiology and Medical Transcription and Coding, Inc. (MTC). The Assurance of Voluntary Compliance says the companies provided transcription, coding and billing services to health care organizations, including in Connecticut, until about August 2024. It says PJ&A, PJ&A Coding, PJ&A Radiology and MTC "are insolvent and inactive." It does not say that of PJI. The companies neither admit nor deny the findings.
What the attorneys general found
The agreement says attackers entered PJ&A's network in March 2023 by remotely logging in with a PJ&A Coding employee's credentials. PJ&A did not require multi-factor authentication for remote access. Over the next month the attackers moved through the network and reached files, including backup database files, that were not encrypted at the file level.
Monitoring software recorded the intruders by at least March 29, 2023, but had not been configured to alert security staff. The agreement says a PJ&A administrator asked in February 2022 for email alerts and they were not set up. The companies learned of the attack on May 2, 2023, when the attackers contacted them.
The exfiltrated database files held records tied to more than 13.3 million people, about 107,960 of them Connecticut residents. The data included names, birth dates, addresses, Social Security numbers, insurance information, admission diagnoses, and laboratory results and medication names from transcription files. Clients notified affected people between Oct. 31, 2023, and Feb. 8, 2024.
Money and conditions
The $300,000 is due within 14 days of the agreement's effective date. Of the total, $2,222,222 is assigned to Connecticut. Of that, $66,666 is payable and $2,155,556 is suspended.
The agreement requires Perry Johnson, Inc., and any affiliate that becomes active again to maintain a written security program, multi-factor authentication for user accounts and remote access, and annual risk assessments and penetration tests. An affiliate counts as active if it has monthly revenue above $5,000 or active contracts with a health care client or its business associate. The agreement also calls for independent third-party assessments. Most of the technical requirements expire after seven years.
The agreement identifies Jeffrey Hubbard, Brittany Larson and David Campbell as PJ&A principals at the time of the attack. The documents do not include a statement from the companies.
