Attorneys general from New York, New Jersey, Connecticut, and Michigan formally announced a comprehensive multi-state settlement on November 6, 2026, resolving enforcement investigations into medical transcription vendor Perry Johnson & Associates (PJ&A). The joint regulatory resolution addresses a devastating cyberattack initially discovered in 2023 that compromised sensitive clinical files, diagnostic records, and Social Security numbers belonging to more than 13.3 million individuals nationwide. Under the negotiated enforcement framework, PJ&A agreed to financial commitments and operational penalties capped at $10 million—including guaranteed statutory fines and binding requirements to deploy enterprise-wide multifactor authentication and cryptographic data controls.
Enforcement Metrics and Settlement Provisions in the PJ&A Resolution
- Joint Investigating State Attorneys General: New York, New Jersey, Connecticut, Michigan
- Target Entity & Healthcare Industry Role: Perry Johnson & Associates (Medical BPO)
- Compromised Records & Mandated Reforms: Clinical Records & SSNs; Mandated MFA & Logs
Why Did the Perry Johnson Breach Compromise 13.3 Million Records?
Operating as a foundational backend business process outsourcing vendor, Nevada-based Perry Johnson & Associates provided specialized audio transcription, clinical documentation, and billing administration for leading healthcare networks, including Northwell Health and NYU Langone. Because the company's technical infrastructure integrated directly into major electronic health record systems, thousands of dictated outpatient notes and diagnostic summaries flowed across its network on a daily basis.
Forensic investigations revealed that unauthorized threat actors infiltrated PJ&A's internal infrastructure in March 2023, exploiting unpatched access portals to maintain undetected network persistence for nearly a month. The exfiltrated data archives encompassed patient names, birthdates, addresses, insurance numbers, and complete Social Security records, paired with confidential clinical diagnoses, lab results, radiological evaluations, and psychiatric medication histories. The breach affected 4.2 million New Yorkers, nearly 540,000 New Jersey residents, and over 107,000 Connecticut patients, making it one of the most severe third-party vendor security compromises in modern healthcare history.
How Did State Regulators Structure the $10 Million Settlement?
Led by New York Attorney General Letitia James and Connecticut Attorney General William Tong, state prosecutors conducted a rigorous technical audit of PJ&A's security architecture. Investigators established that the transcription company maintained systemic technical vulnerabilities, operating production databases without full-disk encryption at rest, failing to enforce mandatory multi-factor authentication across remote access gateways, and maintaining inadequate intrusion logging.
Under the binding consent decree, PJ&A must implement a comprehensive information security management system overseen by a qualified Chief Information Security Officer reporting directly to the executive board. The $10 million settlement structure incorporates an immediate, non-refundable $300,000 administrative penalty alongside substantial conditional funds tied directly to the execution of annual third-party penetration assessments, technical infrastructure overhauls, and workforce phishing awareness training. Failure to demonstrate verified technical compliance within three years triggers immediate collection of the remaining financial penalties.
What Are the Broader Implications for Healthcare Vendor Cybersecurity?
Cybersecurity legal experts observe that the Perry Johnson resolution represents a pivotal shift in state regulatory enforcement strategy, expanding direct legal liability beyond consumer-facing hospitals to encompass third-party service providers and technology contractors.
As healthcare enterprises increasingly deploy generative voice transcription, cloud-hosted radiological diagnostics, and automated revenue-cycle systems, third-party operational connections represent prime attack surfaces for transnational cybercrime syndicates. The multi-state regulatory action delivers an unambiguous mandate across the health-technology supply chain: enterprises handling protected health information can no longer treat enterprise cybersecurity as a negotiable administrative line item, establishing that rigorous cryptographic resilience is an indispensable prerequisite for handling public health data.
