Penalty Amount
$10,000,000
Consumers Affected
13,300,000
A March 2023 breach at the Perry Johnson companies exposed personal and protected health information belonging to more than 13.3 million people. The companies agreed to pay at least $300,000 in penalties, with an additional $9.7 million payable if they fail to meet the agreement, and to implement security, incident-response, and data-handling reforms.
The companies will pay at least $300,000 in penalties, with an additional $9.7 million due to the states if they fail to comply with the agreement. Companies maintaining protected health information must implement a comprehensive information security program and incident-response protocol, security safeguards including multi-factor authentication and encryption, annual risk assessments consistent with HIPAA, and policies for collecting, using, retaining, and disposing of personal health information.
Review vendor and business associate agreements for requirements to use multi-factor authentication for remote access, encrypt sensitive data, manage credentials and assets, and maintain security monitoring that promptly alerts personnel to suspicious activity. Confirm agreements require a documented security program, incident-response procedures, timely notice of suspected or confirmed incidents, annual risk assessments, and appropriate cooperation with investigations. For healthcare and other sensitive-data arrangements, clarify permitted collection, use, retention, and secure disposal of protected health information, and ensure subcontractors are bound by equivalent safeguards; review customer-facing privacy and security commitments for consistency with these obligations.
Entity
Perry Johnson & Associates, Inc.; Perry Johnson, Inc.; Perry Johnson & Associates Coding, Inc.; Perry Johnson & Associates Radiology, Inc.; and Medical Transcription and Coding, Inc.
Industry
TechnologyOfficial Press Release
https://www.njoag.gov/attorney-general-davenport-secures-up-to-10-million-and-critical-reforms-from-companies-that-failed-to-protect-private-medical-data/
2026 1106 Perry Johnson NJ AVC PJ Entity Signed CPsigned
http://www.njoag.gov/wp-content/uploads/2026/11/2026-1106_Perry-Johnson-NJ-AVC-PJ-Entity-Signed-CPsigned.pdf
New Jersey Attorney General Enforcement Page
https://www.njoag.gov/about/divisions-and-offices/division-of-consumer-affairs/
"Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc. (together, the Perry Johnson companies)"
"today secured $10 million from Perry Johnson & Associates, Inc."
"will pay at least $300,000 in penalties to the coalition. If the companies fail to meet the terms of the agreement, they will be liable to pay an additional $9.7 million to the states."
"Implementing annual risk assessment programs consistent with HIPAA;"
"Over the following months, hackers harvested passwords and accessed unencrypted files that contained personal and protected health information."
"At the time, PJ&A did not require users to use multi-factor authentication when remotely accessing the company’s systems."
$10.0M
A March 2023 breach exposed personal and protected health information associated with more than 13.3 million people after attackers accessed company systems using an employee’s credentials. The Perry Johnson companies agreed to pay at least $300,000, with an additional $9.7 million in penalties due if they fail to meet the agreement, and to implement security, incident response, and health-data handling reforms.
$10.0M
A March 2023 breach exposed personal and protected health information belonging to more than 13.3 million people after hackers accessed the companies’ systems, including unencrypted files, and security alerts were not properly configured. The companies agreed to pay at least $300,000 in penalties, with up to $9.7 million more due if they fail to comply, and to implement extensive security, incident-response, and data-handling reforms.
$220.0M
A 36-attorney-general coalition resolved allegations that General Motors collected and sold identifiable driver behavior and location data to data brokers, which supplied it to insurers for use in assessing drivers and potentially raising premiums. The $220 million nationwide settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
New Jersey, the FTC, and a coalition of 19 other states sued Dollar General, alleging that customers were repeatedly charged more at checkout than prices displayed on shelves, tags, and advertisements. The complaint alleges deceptive pricing practices and inadequate safeguards despite consumer complaints; the release does not describe a settlement, penalty, or other remedy imposed.
New Jersey joined a coalition of state attorneys general in filing a notice in Character Technologies, Inc.’s bankruptcy proceedings, raising concerns about the company’s safety and privacy practices and the sensitive conversations it holds, including those involving children and mental health. The states seek safeguards for consumers’ personal information in any sale or transfer of the company’s business or assets; the release does not report a fine or final finding of violations.
A multistate coalition co-led by New Jersey won a federal court order rejecting the Trump Administration’s decision not to request funding for the CFPB. The order struck down that decision and directed the Administration to follow the law and fund the agency; no monetary penalty or privacy violation is described.