Medical services company settles with 4 states over 2023 hack
Original title: Medical services company settles with 4 states over 2023 hack of sensitive patient records
Perry Johnson Companies agreed to pay $300,000 and implement security reforms after a 2023 breach of data for more than 13 million people.
State attorneys general in Connecticut, New Jersey, New York, and Michigan announced a settlement with the Nevada-based Perry Johnson Companies. The company paid $300,000 and will make changes to its security practices. Hackers used an employee's credentials to breach the system. The bad actor obtained passwords and unencrypted patient records containing names, dates of birth, addresses, Social Security numbers, and medical information. The firm learned of the breach when the hackers alerted it.
- Settlement requires cybersecurity program and incident response standards
- Multi-factor authentication and encryption required
- Yearly risk assessment programs mandated
- Data retention and disposal rules established
- Victims
- Perry Johnson Companies
- Organizations
- New York Attorney General Letitia James office
From the original article
2 min read at therecord.mediaThe case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.