Perry Johnson Breach Settlement: $10M Headline, $300,000 Due

The attorneys general of New York, Connecticut, Michigan and New Jersey announced a settlement with Perry Johnson & Associates and four affiliated companies on November 6, 2026, closing their joint investigation into a March 2023 breach of medical transcription files. The headline figure is $10 million. The signed instrument requires $300,000.

Information last verified on November 7, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article covers New York Assurance of Discontinuance No. 26-039 and the parallel Connecticut Assurance of Voluntary Compliance, both signed on or about November 6, 2026, and the New York and Connecticut statutes and federal HIPAA rules they rest on. It does not cover the Michigan or New Jersey instruments, which we were not able to obtain, and it is not a guide to the separate private litigation.

What Happened

New York Attorney General Letitia James accepted Assurance of Discontinuance No. 26-039, resolving an investigation conducted with the attorneys general of Connecticut, Michigan and New Jersey into Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc. and Medical Transcription and Coding, Inc. Connecticut Attorney General William Tong accepted a parallel Assurance of Voluntary Compliance, co-signed by Consumer Protection Commissioner Bryan Cafferelli and dated 11/6/26.

The findings describe a March 2023 intrusion. Attackers logged in remotely through the RD Web application using the credentials of a PJ&A Coding employee, and PJ&A did not require multi-factor authentication for remote access (NY para 4). The exfiltrated database files held records associated with more than 13.3 million individuals, approximately 4.2 million of them New York residents and approximately 107,960 of them Connecticut residents (NY para 10; CT introduction).

Respondents neither admit nor deny the findings (NY para 28).

"Your health is your business, and companies entrusted with personal health information have a duty to rigorously protect it," Attorney General James said in the New York announcement. Attorney General Tong said that "Companies have a responsibility to safeguard sensitive information, and we will not hesitate to hold them accountable when they fail to do so."

The five respondents did different things. PJ&A, PJ&A Coding and PJ&A Radiology provided health information technology services to health care organizations until approximately August 2024: PJ&A itself handled medical transcription, coding, billing, recording, digital dictation and court reporting, while PJ&A Coding did diagnostic coding for insurance and PJ&A Radiology did telehealth radiology (NY para 1). Medical Transcription and Coding licensed health care software to PJ&A (NY para 2), and PJI provided administrative and technical support to the other four (NY para 3).

No Patient Fund and No Claims Process

Readers searching for the Perry Johnson settlement are almost always looking for a payout. There is none.

We searched the full text of both the New York and the Connecticut instruments for restitution, fund, claim, class and credit monitoring language. Neither creates any consumer remedy. Three provisions move money, and all three move it to a state: paragraph 61, which directs $10,000,000 in "penalties and costs" to the attorneys general; paragraph 62, which splits that amount between the four offices; and paragraph 65, which makes a respondent pay a state's enforcement costs if a court finds a violation of the Assurance.

There is no claim form, no eligibility portal, no deadline to file and no monitoring benefit attached to this settlement. Nobody has to do anything, and nobody collects anything.

Connecticut's paragraph 62 adds that its share may be applied to purposes including a consumer protection law enforcement fund, future enforcement, consumer education, litigation, or a local consumer aid or restitution fund, at the sole discretion of the Connecticut Attorney General. That is a state spending discretion, not a route by which an individual files a claim.

Two paragraphs do matter for anyone considering their own options. Paragraph 66 states that the Assurance "is not intended for use by any third party in any other proceeding" and is not an admission of liability. Paragraph 68 states that nothing in it limits or deprives any person of any private right under the law.

Why $10 Million Becomes $300,000

Paragraph 61 sets the structure in three parts.

Respondents must pay $300,000 in full within fourteen days of the effective date. A further $9,700,000 is suspended. The suspended amount becomes immediately due only if the New York Attorney General finds that the respondents' representations about their finances are not materially accurate, or if the respondents or their successors violate the terms of the Assurance.

Paragraph 61(c) states the premise plainly:

The NYAG's agreement to suspend nine million seven hundred thousand dollars ($9,700,000) is expressly premised upon the truthfulness, accuracy, and completeness of Respondents' representations concerning their inability to pay the amount in its entirety due to certain Respondents' insolvency and their ability to comply with the terms of this Assurance. Source: New York Assurance of Discontinuance No. 26-039, para 61(c)

Paragraph 30 supplies the reason: as of the effective date, PJ&A, PJ&A Coding, PJ&A Radiology and Medical Transcription and Coding are insolvent and inactive. PJI is the one respondent not on that list.

The state-level arithmetic follows the same pattern. New York takes $3,333,334 on paper and $100,002 in cash (NY para 62). Connecticut takes $2,222,222 on paper and $66,666 in cash (CT para 62). Those two instruments account for $5,555,556 of the $10,000,000 nominal total and $166,668 of the $300,000 in cash that actually falls due. The Michigan and New Jersey allocations appear in their own Assurances, which we were not able to obtain, so we do not state them.

Both press releases do disclose the structure, in the paragraph after the headline: the companies "will pay at least $300,000 in penalties to the coalition" and become liable for the additional $9,700,000 only if they fail to meet the agreement's terms. The New York release is headlined "Secures Up to $10 Million." The qualifier, not the number, is what matches the instrument.

What the Attorneys General Found

The findings are specific, and they read less like a sophisticated attack than like a series of ignored internal controls.

Nine user accounts, including the one the attackers used, were created by a PJ&A system administrator on May 6, 2022 and assigned passwords that were nearly identical, differing only in the final digit (NY para 14). The administrator then emailed the credentials for all nine accounts in a single message to several managers, who forwarded it on (NY para 15). The instrument quotes the company's own rule:

Administrators must not communicate passwords via email or other electronic communication. Source: PJ&A password policy, quoted in New York Assurance No. 26-039, para 16

That same email inadvertently included the address of an employee at another company. The administrator noticed, but did not revoke the credentials (NY para 17). PJ&A policy required a 90 day password rotation; ten months later, when the breach occurred, the nine passwords were unchanged (NY para 18). Password rotation was disabled on the two PJI accounts compromised in the attack (NY para 19).

Monitoring software recorded the intruders. PJI maintained software that identified and logged the malicious activity at least as early as March 29, 2023, but the software had been improperly configured and sent no alerts to security personnel (NY para 6). Paragraph 7 goes further: in February 2022 a PJ&A system administrator asked a PJI administrator whether the software could send email alerts, was told it could, and specifically requested that it be configured to do so. It was not done.

PJ&A and PJI learned of the attack on May 2, 2023, when the attackers contacted employees, said they had taken tens of thousands of files, and demanded payment for their deletion (NY para 8).

The count may be incomplete

Paragraph 10 is carefully worded. The database files contained "records associated with more than 13.3 million individuals." Both press releases also use the looser phrase, saying the breach "impacted 13.3 million individuals." The difference is not cosmetic: a record count associated with individuals is not a headcount of distinct people.

Paragraph 11 records that the attackers also reached files in PJ&A and PJI shared network space containing personal information and protected health information, and that PJ&A and PJI did not review those files to identify additional affected individuals. The 13.3 million figure describes the database files. Nobody counted the rest.

What the Law Actually Says

The statutory basis of this settlement is worth reading closely, because the HIPAA counts are charged rather than borrowed.

New York accepted the Assurance under Executive Law 63(15), in lieu of commencing a statutory proceeding for violations of General Business Law 899-aa and 899-bb and, as independent bases, the HIPAA Security Rule at 45 C.F.R. Part 160 and Part 164 Subparts A and C, and the HIPAA Breach Notification Rule at 45 C.F.R. Part 164 Subpart D (NY para 31). The investigation itself was commenced under Executive Law 63(12) and GBL 899-aa and 899-bb.

State enforcement of the federal HIPAA rules has an express statutory home. 42 U.S.C. 1320d-5(d), added by the HITECH Act, lets a state attorney general sue as parens patriae in federal district court for violations of the HIPAA part, and Connecticut's paragraph 1 names HIPAA as amended by HITECH as the authority it proceeds under. New York charges the rules without naming that provision, accepting the Assurance under its own Executive Law instead.

HIPAA here is not a yardstick borrowed to measure reasonableness under a state statute. It is a charging provision. Finding 26 enumerates sixteen subparagraphs of those two rules the three PJ&A entities violated, from 45 C.F.R. 164.308(a)(1)(i) through 45 C.F.R. 164.404. Connecticut's paragraph 1 grounds the same authority in HIPAA as amended by the HITECH Act, alongside the Connecticut Unfair Trade Practices Act at Conn. Gen. Stat. 42-110a et seq., the Connecticut breach notification law at Conn. Gen. Stat. 36a-701b, and the Safeguards Law at Conn. Gen. Stat. 42-471.

Two findings are worth isolating.

Paragraph 23 finds that PJ&A, PJ&A Coding and PJ&A Radiology conducted general risk assessments but never conducted a HIPAA risk analysis or evaluated their safeguards against Security Rule requirements, in violation of the rule. Paragraph 22 identifies the two provisions that requirement sits in: the periodic technical and nontechnical evaluation at 45 C.F.R. 164.308(a)(8), and the risk analysis and risk management process at 45 C.F.R. 164.308(a)(1)(ii).

Paragraphs 24 and 25 find a broken contract chain. All three PJ&A entities were business associates subject to the Security Rule (NY para 21), and HIPAA permits a business associate to disclose electronic protected health information to a subcontractor only if the subcontractor has agreed in writing to safeguard it (NY para 24, citing 45 C.F.R. 164.308(b) and 164.314(a)).

The PJ&A entities nevertheless let PJI have technical access to systems containing protected health information without contractually requiring PJI to keep it confidential or protect it. If you have ever wondered what a business associate agreement is actually for, paragraph 25 is the answer. The question of when one has to be in place runs all the way down the subcontractor chain, not just to the first vendor.

The notification finding

Paragraph 27 is where the delay becomes a violation. It finds that the respondents' conduct violated GBL 899-aa, "which requires disclosure of a data breach in the most expedient time possible and without unreasonable delay," and GBL 899-bb, which requires reasonable safeguards. The thirty day outer deadline now in GBL 899-aa(2) did not exist when PJ&A discovered this breach. It was added by chapter 647 of the laws of 2024 (Senate Bill S2659-B), delivered to the Governor on December 12, 2024, signed on December 21, 2024 and effective immediately; the bill amended the section as it stood under chapter 117 of the laws of 2019 and inserted the thirty day language as new matter. That is about twenty months after the May 2, 2023 discovery, so the expedient-time standard in paragraph 27 is the whole of what New York's breach notification duty required of this breach.

Neither press release gives a day count, so here is the arithmetic from the instrument's own dates. PJ&A learned of the attack on May 2, 2023 (NY para 8). It began contacting clients in July 2023 (NY para 10). The breach was publicly announced on November 3, 2023 (NY para 32(e)). PJ&A's clients notified affected individuals between October 31, 2023 and February 8, 2024 (NY para 12), which is 182 to 282 days after discovery.

Connecticut's paragraph 27 states its own standard: the Connecticut Data Breach Notification Law "requires disclosure of a data breach without unreasonable delay and no later than sixty (60) days from breach discovery." On the instrument's dates, the first individual notices went out roughly four months past that outer limit, which is the sort of gap Connecticut's notice deadline is written to prevent.

Note who sent those notices. PJ&A told its clients, and the health care organizations it served told the patients.

What the Companies Must Do Now

The forward-looking terms are real, but their reach is narrower than the press releases suggest.

Paragraph 37 applies the security obligations in paragraphs 38 through 59 to PJI, and to any other PJ entity from the first business day after it becomes "Active." Paragraph 32(a) defines Active as generating monthly revenue over $5,000 or holding active contracts with a covered entity or business associate. Four of the five respondents are insolvent and inactive, so for now the operative program obligations sit on PJI.

An Active entity must maintain a written information security program adopting zero trust architecture principles where feasible, with documented annual risk assessment (para 38), and designate a qualified security lead who reports in writing at least semi-annually to the chief executive officer, senior management and the board or an equivalent body, on staffing, budget, implementation and barriers (para 39).

The specific safeguards track the findings almost line by line. On access: multi-factor authentication for all individual user accounts including system administrator accounts and for remote network access (para 43); strong passwords with rotation and no default, shared or generic passwords (para 44); encryption of personal and protected health information (para 45); and network segmentation (para 49).

On detection and governance: centralized logging with automated alerts to security personnel (para 51); intrusion detection and prevention (para 52); endpoint detection and response (para 53); data loss prevention (para 50); an asset inventory (para 46); annual HIPAA-consistent risk assessments (para 47); annual penetration testing (para 48); retention and disposal policies (para 55); and a written incident response plan (para 56).

Read against the findings, that is a list of the controls that were missing.

Deadlines and duration:

• Notice to responsible management employees and training within 90 days of the effective date (para 40).
• An account access audit within 90 days of the effective date (para 42).
• A first independent third-party assessment within 90 days of becoming Active, delivered to the New York Attorney General within two weeks of completion, then annually for three years (para 58).
• Documentation retained at least six years and produced to the New York Attorney General within fourteen days of a written request, with no confidentiality, trade secret, work product or privilege withholding (para 60).
• The obligations in paragraphs 41 through 53 expire at the conclusion of the seven year period after the effective date (para 73).

Three terms follow the people rather than the corporate shells, and they are the most durable part of the instrument.

Paragraph 34 requires any non-Active PJ entity to return or destroy all personal and protected health information within ten business days of the date it is no longer required to retain it.

Paragraph 35 bars the respondents from hiring or engaging anyone who served as a president, treasurer, secretary or director of PJ&A, or who had primary responsibility for managing privacy, information security or HIPAA compliance, at the time of the incident or in the five years before it, into any role carrying direct or indirect responsibility for privacy, information security or HIPAA compliance.

Paragraph 36 requires sixty days' written notice to the New York Attorney General before a non-Active PJ entity becomes Active, before a merger, acquisition or change of control, and before a PJ Owner incorporates, acquires or gains more than a 15% interest in any covered entity or business associate.

The Private Case Is Separate and Still Pending

The Assurance is not the only proceeding arising from this breach, and paragraph 68 expressly preserves private rights.

The Judicial Panel on Multidistrict Litigation centralized the private suits on January 30, 2024, creating In re: Perry Johnson & Associates Medical Transcription Data Security Breach Litigation, MDL No. 3096, in the Eastern District of New York. The transfer order covered 26 actions originally filed in the District of Nevada and the Eastern District of New York, naming PJ&A along with medical provider defendants including Northwell Health, Cook County Health, Bon Secours Mercy Health and Salem Regional Medical Center.

The panel's order records that those plaintiffs alleged the breach "potentially affected approximately nine million individuals'" protected health information or personal identifying information. The attorneys general, nearly three years later, found records associated with more than 13.3 million. Both numbers describe a count that moved.

The JPML's own statistics report dated November 2, 2026 lists MDL No. 3096 as an active litigation before Judge Rachel P. Kovner, with 51 actions now pending out of 58 historically. We did not locate a court-approved class settlement or a claims process in that case, and we state no view on how it resolves.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The gap between "up to $10 million" and $300,000 is not a trick. It is what enforcement looks like when the defendant has already dissolved. Four of five respondents were insolvent and inactive before the ink dried, and an attorney general who insists on collecting the full penalty in cash from an empty shell gets a judgment and nothing else. Pricing the penalty at $10,000,000 and suspending $9,700,000 against a solvency representation at least creates a tripwire: if the financial representations prove inaccurate, the full amount comes due under paragraph 61(b).

What deserves scrutiny is the announcement, not the instrument. Both press releases put the suspension in the paragraph after the headline, which is more than many do. But a reader who sees "Secures Up to $10 Million" about a breach of their own medical records will reasonably assume a fund exists. None does, and the instruments never suggested otherwise. The honest summary is that four states secured $300,000 in cash, payable within fourteen days, and a set of security commitments from one still-operating company.

The structural problem this settlement is quietly built around is the disposable vendor. PJ&A stopped providing services around August 2024, about nine months after the breach became public, and the entities that held the data are now insolvent. A security program imposed on an insolvent shell is worth nothing, and paragraphs 41 through 53 sunset after seven years anyway.

The provisions with teeth are the ones attached to people: the officer and compliance-manager hiring bar in paragraph 35, and the paragraph 36 trigger that requires notice before a PJ Owner takes more than 15% of any other covered entity or business associate. Those terms assume the next entity will be a new one, and they try to follow the principals into it.

The business associate findings are the part every health care compliance team should read. The weakest link was not PJ&A's own perimeter but its undocumented subcontractor relationship: PJI managed the monitoring software, held technical access to systems containing protected health information, and had no written safeguarding obligation (NY paras 24 to 25). PJI is also the only respondent still solvent, which means the entity that was never properly papered into the HIPAA chain is now the entity carrying the compliance program. A covered entity that signed an agreement with PJ&A and treated the chain as closed was in fact relying on a subcontractor arrangement the Assurance found was never papered at all.

The notification sequence is the second lesson. A business associate that takes until July 2023 to tell its clients about a May 2023 discovery makes every covered entity it serves late, because the patient notices cannot go out until the clients know. The first individual notices landed 182 days after discovery, and the last 282 days after (NY paras 8 and 12). Neither office published a day count, and paragraph 27 is the only place the delay is characterized as a violation.

Finally, the legal mechanism. This is a state attorney general charging the HIPAA Security Rule and Breach Notification Rule as independent violations, not citing them for color. Federal enforcement is untouched: paragraph 67 says nothing in the Assurance waives or limits any authority assertable by or on behalf of the federal government or any of its agencies.

What the state route adds is reach, and the federal numbers show why that matters. 42 U.S.C. 1320d-5(d)(2) caps a state attorney general's HIPAA damages at up to $100 per violation and at $25,000 for all violations of an identical requirement in a calendar year. Sixteen HIPAA counts cannot carry a $10,000,000 nominal figure; the state statutes are what carry it.

So a four-state coalition proceeding under Executive Law 63(15) and the Connecticut Unfair Trade Practices Act can charge the federal rules, stack state safeguards and notification statutes on top, and negotiate governance terms that attach to the owners rather than to the balance sheet. This instrument shows both that reach and its collection limit in the same document.

How This Affects You

If a hospital or health system sent you a notice between October 31, 2023 and February 8, 2024 mentioning Perry Johnson & Associates, this settlement does not pay you and does not ask anything of you. There is no claim to submit and no deadline to watch.

That matters for a practical reason. Because the headline says $10 million, breach settlements like this one reliably attract sites offering to "file your claim" for a fee. No claims process exists under these instruments, so any page asking for a Social Security number, bank details or a filing fee to collect a PJ&A settlement payment is not connected to the four attorneys general. The official documents are the two Assurances linked in the sources below.

The settlement provides no credit monitoring. People concerned about exposure of a Social Security number generally look at security freezes and fraud alerts placed directly with the three nationwide credit bureaus, which is a step available regardless of any settlement.

For covered entities, the operative general point is contractual rather than technical. HIPAA requires written safeguarding assurances down the subcontractor chain (45 C.F.R. 164.308(b) and 164.314(a), as applied in NY paras 24 and 25), and the finding here was that the chain stopped at the first vendor. What produced the violation was the absence of a document, not the absence of an expectation.

This is general legal information, not legal advice. It covers New York Assurance of Discontinuance No. 26-039 and the parallel Connecticut Assurance of Voluntary Compliance, the New York and Connecticut statutes they rest on, and the federal HIPAA Security and Breach Notification Rules, as verified on November 7, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• Reporting HIPAA breaches: who notifies whom, and when
• New York's data breach notification requirements
• Connecticut data breach notification rules

---

Last updated: 2026-11-07. This is a developing story; details verified as of 2026-11-07.

Frequently Asked Questions

Do I get money from the Perry Johnson settlement?

No. The New York and Connecticut Assurances signed on or about November 6, 2026 direct all $10,000,000 in penalties and costs to the four state attorneys general. Neither instrument creates a fund, a payment or any benefit for affected individuals.

Is there a claim form for the PJ&A data breach settlement?

No. There is no claim form, portal, eligibility check or filing deadline under these state settlements. Any site asking for a fee or for a Social Security number to claim a PJ&A settlement payment is not connected to the attorneys general of New York, Connecticut, Michigan or New Jersey.

Why is the headline $10 million if only $300,000 is payable?

Paragraph 61 of New York Assurance No. 26-039 requires $300,000 within fourteen days and suspends $9,700,000. Paragraph 61(c) states the suspension rests on the respondents' representations that they cannot pay in full because certain respondents are insolvent. The suspended amount becomes due if those financial representations are inaccurate or if the respondents violate the Assurance.

How many people were affected by the PJ&A breach?

The New York Assurance finds at paragraph 10 that the exfiltrated database files held records associated with more than 13.3 million individuals, approximately 4.2 million of them New York residents. Connecticut puts its residents at approximately 107,960. Paragraph 11 notes that PJ&A and PJI never reviewed additional accessed files in shared network space to identify further affected individuals.

Does the settlement give affected patients credit monitoring?

No. We searched the full text of both the New York and the Connecticut instruments and neither provides credit monitoring, identity protection or any other consumer remedy. The only monetary provision is paragraph 61, which pays the state attorneys general.

Which states settled with Perry Johnson & Associates?

New York, Connecticut, Michigan and New Jersey. Footnote 1 of the New York Assurance states that each office is entering its own Assurance incorporating the same substantive terms, with differences arising from local rules and state laws. We verified the New York and Connecticut instruments and their dollar shares; we were not able to obtain the Michigan or New Jersey instruments.

Can a state attorney general enforce HIPAA?

New York accepted this Assurance under Executive Law 63(15) in lieu of a proceeding for violations that include the HIPAA Security Rule at 45 C.F.R. Part 160 and Part 164 Subparts A and C and the Breach Notification Rule at 45 C.F.R. Part 164 Subpart D. Connecticut's paragraph 1 grounds the same authority in HIPAA as amended by the HITECH Act, alongside its own consumer protection and safeguards statutes.

Is there still a lawsuit over the PJ&A data breach?

Yes. The Judicial Panel on Multidistrict Litigation centralized the private suits on January 30, 2024 as MDL No. 3096 in the Eastern District of New York. The panel's statistics report dated November 2, 2026 lists it as active litigation before Judge Rachel P. Kovner with 51 actions pending. Paragraph 68 of the Assurance states that nothing in it limits any person's private rights.

What did the attorneys general say the companies did wrong?

The findings include no multi-factor authentication for remote access, nine accounts issued nearly identical passwords and emailed together in one message contrary to PJ&A's own policy, passwords unchanged for ten months against a 90 day rotation rule, monitoring software that logged the intrusion from March 29, 2023 but was never configured to alert anyone despite a February 2022 request, no HIPAA risk analysis, and no written safeguarding agreement with the subcontractor that held technical access to protected health information.