Perry Johnson’s US$10m breach settlement: US$300,000 due, about 2 cents a patient

01Why up to US$10m means US$300,000

The suspension is written into the settlement, an Assurance of Discontinuance. The states agreed to it on the companies’ representations “concerning their inability to pay the amount in its entirety due to certain Respondents’ insolvency”. Four of the five companies, Perry Johnson & Associates (PJ&A), its coding and radiology units and Medical Transcription and Coding, are “insolvent and inactive”; PJ&A stopped serving health care clients around August 2024. The fifth, Perry Johnson, Inc. (PJI), provided their administrative and technical support. The companies neither admit nor deny the findings.²

02The two controls the regulators named

No second factor on remote access. In March 2023 attackers logged in remotely through the RD Web application with a PJ&A Coding employee’s credentials; PJ&A “did not require users to provide multi-factor authentication when remotely accessing PJ&A systems”. How the credentials were obtained was never found, but the account was one of nine created in May 2022 with passwords that differed only in the last digit, sent together in one email, and still unchanged ten months later against a 90-day rotation policy.²

Monitoring that told no one. PJI’s monitoring software “identified and recorded the threat actors’ malicious activity at least as early as March 29, 2023”, but was not set to alert security staff. A PJ&A administrator had asked in February 2022 for email alerts to be switched on; “this was not done”. The companies learned of the attack on 2 May 2023, when the attackers contacted employees and demanded payment to delete the files, 34 days after the first recorded activity by our count. The files held names, dates of birth, addresses, Social Security numbers, diagnoses, insurance details and test results; PJ&A’s clients notified patients from 31 October 2023 to 8 February 2024.²¹

The core controls bind PJI, and any Perry Johnson company that becomes active again, for seven years: multi-factor authentication for every account and for remote access, centralised logging with automated alerts to security staff, encryption of patient data, annual penetration tests, plus an independent assessment within 90 days of becoming active. Inactive companies must return or destroy the data they hold, and none may hire PJ&A’s former officers, or those who ran its security, into a security or privacy role.²

In India, the Digital Personal Data Protection Act, 2023 sets a penalty of up to ₹250 crore for failing to take reasonable security safeguards; the safeguard and breach-reporting duties of the DPDP Rules, 2025 apply from 13 May 2027.³⁴ Indian firms that transcribe foreign records already sit in such chains, as Chennai transcribers who heard Australian court audio did.