Penalty Amount
$10,000,000
Consumers Affected
13,300,000
A March 2023 breach exposed personal and protected health information belonging to more than 13.3 million people after hackers accessed the companies’ systems, including unencrypted files, and security alerts were not properly configured. The companies agreed to pay at least $300,000 in penalties, with up to $9.7 million more due if they fail to comply, and to implement extensive security, incident-response, and data-handling reforms.
The companies must pay at least $300,000 in penalties and costs, with an additional $9.7 million payable if they fail to meet the agreement’s terms. Companies maintaining protected health information must maintain a comprehensive security program and incident-response protocol; implement safeguards for multifactor authentication, passwords, encryption, and asset management; conduct annual risk assessments consistent with HIPAA; and maintain policies for collection, use, retention, and disposal of personal health information.
Review vendor and business associate agreements with providers that access, store, or process protected health information, including data-processing and HIPAA-related terms. Confirm contracts require multifactor authentication for remote access, encryption of sensitive files, effective monitoring and security alerts, password and asset management, annual risk assessments, and documented security and incident-response programs. Tighten breach-notification clauses to require prompt notice and cooperation, and verify that data-use, retention, and disposal clauses set clear limits and secure deletion requirements; customer-facing privacy notices and employee access controls should also accurately reflect these safeguards.
Entity
Perry Johnson & Associates, Inc.; Perry Johnson, Inc.; Perry Johnson & Associates Coding, Inc.; Perry Johnson & Associates Radiology, Inc.; and Medical Transcription and Coding, Inc.
Industry
HealthcareOfficial Press Release
https://portal.ct.gov/ag/press-releases/2026-press-releases/attorney-general-tong-secures-settlement-from-companies-that-failed-to-protect-private-medical-data
perry johnson final.pdf?rev=95bd5fa1fd394287b7a93b8519670db1
https://portal.ct.gov/-/media/ag/press_releases/2026/perry-johnson-final.pdf?rev=95bd5fa1fd394287b7a93b8519670db1&hash=95AF22FB7E68B71E8A76700BDA5835BF
Connecticut Attorney General Enforcement Page
https://portal.ct.gov/AG/Privacy/Privacy-Resources
"Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc."
"As a result of the coalition’s investigation, the companies will be required to maintain robust security and retention policies and practices and will pay at least $300,000 in penalties to the coalition. If the companies fail to meet the terms of the agreement, they will be liable to pay an additional $9,700,000 to the states."
"Implementing annual risk assessment programs consistent with HIPAA;"
"Over the following months, hackers harvested passwords and accessed unencrypted files that contained personal and protected health information."
"At the time, PJ&A did not require users to use multi-factor authentication when remotely accessing the company’s systems."
"The leaked files contained records associated with more than 13.3 million people."
$10.0M
A March 2023 breach exposed personal and protected health information associated with more than 13.3 million people after attackers accessed company systems using an employee’s credentials. The Perry Johnson companies agreed to pay at least $300,000, with an additional $9.7 million in penalties due if they fail to meet the agreement, and to implement security, incident response, and health-data handling reforms.
$10.0M
A March 2023 breach at the Perry Johnson companies exposed personal and protected health information belonging to more than 13.3 million people. The companies agreed to pay at least $300,000 in penalties, with an additional $9.7 million payable if they fail to meet the agreement, and to implement security, incident-response, and data-handling reforms.
Connecticut Attorney General William Tong and a 23-state coalition obtained a court ruling declaring unlawful federal immigration-enforcement conditions placed on Congressionally authorized public safety grants. The court permanently enjoined the federal government from implementing or enforcing those conditions; the release does not describe a privacy violation or monetary penalty.
Connecticut Attorney General William Tong co-led a bipartisan coalition of 45 attorneys general urging Congress to pass the Kids Online Safety Act. This was a legislative advocacy effort, not a new enforcement action; the release discusses prior investigations into platforms’ effects on children and a separate Meta settlement.
Connecticut Attorney General William Tong joined a coalition of 24 attorneys general and two governors in opposing proposed changes to the 2030 Census. The coalition argued the proposal would exclude people from the count, remove demographic questions, and replace the usual-residence standard; this was a comment-letter action, not a penalty or enforcement order.
Connecticut Attorney General William Tong joined attorneys general from 17 states in an amicus brief urging the New York Court of Appeals to preserve state authority to pursue fraud cases. The underlying civil case alleges that Donald Trump and his co-defendants inflated asset values to obtain better loan and insurance terms; this press release announces advocacy, not a new enforcement order or penalty.