For: people who received a notice about the 2023 Perry Johnson & Associates (PJ&A) breach, and healthcare organizations that outsource transcription, coding or billing. This article is based on the press releases of the New York, Connecticut and New Jersey attorneys general, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who received a notice about the 2023 Perry Johnson & Associates (PJ&A) breach, and healthcare organizations that outsource transcription, coding or billing.
- Confirmed so farSee the table ↓
- People affected
- Data exposed
- Not yet confirmed
- Michigan's release and its count
- How the companies' responsibility is treated in the settlement document
- Affected counts by client healthcare organization
1 more
- Whether further notices or support follow the settlement
- What to do nowSee the steps ↓
- Confirm your credit freeze is still in place
- Check your benefit statements for care you did not receive
- Assume diagnoses and test results were exposed, and prepare for threats
2 more
- Be suspicious of messages that use the settlement as a pretext
- Ask the provider that notified you why this company had your data
- Where to verify (source)All sources ↓
- New York Attorney General, "Attorney General James Secures Up to $10 Million and Critical Reforms From Companies That Failed to Protect Private Medical Data" (November 6, 2026)
- Last checked
- As of November 8, 2026
Follow-up plans and what we checked
The releases say nothing about follow-up information. As of November 8, 2026, this site had confirmed the releases of New York, Connecticut and New Jersey. Michigan's release could not be confirmed.
What to do today if you received a notice
Confirm your credit freeze is still in place
Social Security numbers were among the exposed items, so this is the most effective step. You can place a free security freeze with Equifax, Experian and TransUnion. If you placed one after the 2023 notice, check that it has not been lifted. The US Federal Trade Commission (FTC) page in the sources explains how.
Check your benefit statements for care you did not receive
A name, date of birth, insurance information and hospital account number together can be used to receive care or bill in someone else's name. Look through your insurer's explanation of benefits for visits, prescriptions or equipment you do not recognize. If you find one, contact your insurer and the provider listed.
Assume diagnoses and test results were exposed, and prepare for threats
Transcription files included test results and medication names. If someone claims to know your diagnosis and asks for money, do not pay; talk to the FTC or the police. The releases do not say any such contact has happened. It is something that can happen in general, so prepare for it.
Be suspicious of messages that use the settlement as a pretext
The releases do not say victims will be paid. A call or message about a "settlement payout," an "account check" or a "fee" is suspect from the moment it reaches you uninvited. Check by opening your state attorney general's official website yourself (how to spot these: What is phishing?).
Ask the provider that notified you why this company had your data
According to the New York release, PJ&A provided services such as coding, billing and recording to healthcare organizations across the country. From a patient's side it is a company you never contracted with. You can ask the provider that treated you or notified you how far your data was shared with its contractors.
What happened (from the attorneys general's releases)
This section is based on the November 6, 2026 releases of the New York, Connecticut and New Jersey attorneys general. It is the states' account, not the companies'. The companies are Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc. and Medical Transcription and Coding, Inc., which the releases call the "Perry Johnson companies."
Employee credentials
No multi-factor authentication on remote access
↓→
Months of access
Activity recorded, no alert sent
↓→
Discovery
About two months later, when the hackers made contact
This is the states' account, not the companies'.
March 2023
According to the states, hackers used the credentials of a PJ&A Coding employee to access PJ&A's systems.Following months
The hackers collected passwords and accessed unencrypted files (per the states).About two months later
PJ&A learned of the breach only when the hackers contacted it (per the states).November 6, 2026
The attorneys general of four states announced the settlement.
- Companies
- Perry Johnson & Associates, Inc. (PJ&A) and four affiliated companies
- Breach
- March 2023; about 13.3 million people nationwide
- Counts by state
- About 4.2 million New Yorkers; about 539,669 in New Jersey; about 107,960 in Connecticut. Michigan not confirmed
- Items exposed
- Names, dates of birth, home addresses, Social Security numbers; hospital account numbers, diagnoses, insurance information; clinical information in transcription files (laboratory and diagnostic test results, medication names)
- Settlement amount
- Up to $10 million. At least $300,000 in penalties to the states; a further $9,700,000 owed to the states if the companies fail to meet the agreement's terms
- Amounts by state
- New York: at least $100,000 in penalties and costs. Connecticut: $66,666. New Jersey: not stated in its release
- Document type
- New Jersey's release links an Assurance of Voluntary Compliance. The other releases do not name the document in their text
The causes the states cite
The releases describe the following conditions. This is the states' account, not a statement from the companies.
| Item | The states' account | Status |
|---|---|---|
| People affected | About 13.3 million nationwide | Confirmed (states) |
| Data exposed | Name, date of birth, address, Social Security number, hospital account number, diagnosis, insurance and clinical information | Confirmed (states) |
| Entry | A PJ&A Coding employee's credentials were used | States' account |
| Remote access | Multi-factor authentication was not required | States' account |
| Files | Unencrypted files were accessed; passwords were collected | States' account |
| Log monitoring | PJI's software recorded the activity but was not configured to alert security staff | States' account |
| Discovery | About two months later, when the hackers contacted the company | States' account |
| How the credentials were obtained | Not in the releases | Not stated |
| Data retention as a cause | Not cited as a cause; retention appears only in the required reforms | Not stated |
| Whether the companies admitted a violation | Not in the New York or Connecticut releases | Not stated |
How to read this: a settlement is not a court ruling that the law was broken
The New York release's headline describes the companies as having "Failed to Protect" private medical data, but none of the releases says the companies broke the law or that they admitted responsibility. This site does not state that the companies broke the law beyond what the releases say.
What the companies must do
The reforms common to the releases are:
- Maintain a comprehensive information security program and incident response protocol
- Put in place multi-factor authentication, password management, encryption and asset management safeguards and policies
- Run annual risk assessments consistent with HIPAA
- Maintain policies and procedures governing the collection, use, retention and disposal of personal health information
New Jersey's release does not describe an independent monitor or a reporting schedule.
What this combination of data can lead to
In general, combinations like the following can be misused. This does not mean it has happened here.
- Name + date of birth + Social Security number + address: attempts to open accounts or credit, or to claim a tax refund fraudulently
- Name + insurance information + hospital account number: care obtained or billed in someone else's name
- Diagnoses and medication names: convincing contact or threats that rely on knowing the person's health condition
What healthcare organizations and clients can learn
The states' account contains points a client can check in its own contractor oversight. This section keeps to what was published and turns it into items to verify in your own contracts and systems.
- Multi-factor authentication on remote access. The states cite its absence. Confirm that your contractor requires it on every route into its systems (VPN, remote desktop, cloud admin consoles), by looking at the settings or an audit report rather than the contract wording. Guide: Multi-factor authentication guide.
- Test where log alerts go, not just that logs exist. The states say activity was recorded but no alert reached security staff. A first step is to run a test, such as a login from an unusual place and a large file read, and confirm someone is notified.
- Set retention and disposal in the contract. Retention is not cited as a cause, but it is in the required reforms. State how long the contractor keeps transcribed audio and files, when it deletes them, and ask for proof of deletion. Holding less means less to lose.
- Look for unencrypted file stores. The states say unencrypted files were accessed. Ask your contractor whether the locations that hold clinical information are encrypted.
- Know your contractor's contractors. A patient may have no contract with a company, yet data flows to it. Agree in advance who your contractor subcontracts to and who is responsible for notification.
Sources (public records)
The facts in this article are based on the public statements below.
- New York Attorney General, "Attorney General James Secures Up to $10 Million and Critical Reforms From Companies That Failed to Protect Private Medical Data" (November 6, 2026) — ag.ny.gov
- Connecticut Attorney General, press release (November 6, 2026) — portal.ct.gov
- New Jersey Attorney General, press release (November 6, 2026) — njoag.gov
- The Record, "Medical services company settles with 4 state AGs" (press report, supporting) — therecord.media
- US Federal Trade Commission, "Credit Freezes and Fraud Alerts" — consumer.ftc.gov
Update history
2026-11-08: First version, based on the November 6, 2026 releases of the New York, Connecticut and New Jersey attorneys general. Michigan's release could not be confirmed. The article will be updated when the states or the companies publish more.
Read next
- The wider picture of US healthcare breaches: US healthcare data breaches (2026)
- A company that holds old medical records: The Aesto Health breach
- Another large healthcare-related case: The AdaptHealth breach
- Protecting remote access: Multi-factor authentication guide
- Spotting follow-on scams: What is phishing?