Attorney General James Secures Up to $10 Million and Critical Reforms From Companies That Failed to Protect Private Medical Data

NEW YORK – New York Attorney General Letitia James and a coalition of three other attorneys general today secured $10 million from Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc. (together, the Perry Johnson companies) following a March 2023 data breach that impacted 13.3 million individuals, including approximately 4.2 million New Yorkers. PJ&A was an information technology company that provided services such as coding, billing, and recording to health care organizations across the country, including in New York. As a result of the coalition’s investigation, the companies will be required to maintain robust security and retention policies and practices and will pay at least $300,000 in penalties to the coalition. If the companies fail to meet the terms of the agreement, they will be liable to pay an additional $9,700,000 to the states. New York will receive at least $100,000.

“Your health is your business, and companies entrusted with personal health information have a duty to rigorously protect it,” said Attorney General James. “PJ&A failed its basic responsibility to guard patients’ data, leading to the exposure of millions of New Yorkers’ private information. As a result of our investigation, PJ&A will make critical changes to protect patients’ data to ensure a data breach like this one does not happen again.”

An investigation by the Office of the Attorney General (OAG) found that in March 2023, hackers accessed PJ&A’s systems using the credentials of a PJ&A Coding employee. At the time, PJ&A did not require users to use multi-factor authentication when remotely accessing the company’s systems. Over the following months, hackers harvested passwords and accessed unencrypted files that contained personal and protected health information. The investigation revealed that although PJI’s software identified and recorded the hacker’s activity, it was not properly configured to provide alerts to security personnel. PJ&A only became aware of the breach when hackers contacted them two months later.

The leaked files contained records associated with more than 13.3 million individuals, approximately 4.2 million of which lived in New York. The records included personal and private information such as names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical information from medical transcription files, such as laboratory and diagnostic testing results and medication names.

As a result of Attorney General James and the coalition’s investigation, any Perry Johnson company that maintains protected health information must implement robust data handling and security policies to better protect consumers, including:

• Maintaining a comprehensive information security program and incident response protocol;
• Enacting standard multi-factor identification, password management, encryption, and asset management safeguards and policies;
• Implementing annual risk assessment programs consistent with HIPAA;
• Maintaining policies and procedures governing the collection, use, retention, and disposal of personal health information.

The companies will also pay at least $300,000 to the states, of which New York will receive $100,000 in penalties and costs. If the companies fail to meet the terms of the agreement, they will be liable to pay an additional $9,700,000 to the states.

Attorney General James is a leader in holding companies accountable for data security failures that put consumers at risk. In October 2026, Attorney General James secured $2.7 million from a pediatric health network and IT company for failing to protect consumer data. In September 2026, Attorney General James secured $2.3 million and reforms from Labcorp after a major data breach. In July 2026, Attorney General James secured $18 million from 23andMe for failing to protect customers’ genetic data. In December 2025 Attorney General James secured $500,00 from a Capital Region health care provider for failing to protect patients’ information. In November 2025, Attorney General James secured $1.7 million from Illuminate Education after sensitive student data was stolen in a data breach. 

For New York, this matter was handled by Senior Enforcement Counsel Jordan Adler of the Bureau of Internet and Technology, under the supervision of Bureau Chief Kim Berger and Deputy Bureau Chief Clark Russell. The Bureau of Internet and Technology is part of the Division for Economic Justice, which is led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Meghan Faux.