Penalty Amount
$10,000,000
Consumers Affected
13,300,000
A March 2023 breach exposed personal and protected health information associated with more than 13.3 million people after attackers accessed company systems using an employee’s credentials. The Perry Johnson companies agreed to pay at least $300,000, with an additional $9.7 million in penalties due if they fail to meet the agreement, and to implement security, incident response, and health-data handling reforms.
The companies will pay at least $300,000 in penalties and costs, with an additional $9.7 million payable if they fail to meet the agreement. Companies maintaining protected health information must maintain a comprehensive information security program and incident response protocol; implement safeguards including multi-factor identification, password management, encryption, and asset management; conduct annual risk assessments consistent with HIPAA; and maintain policies governing the collection, use, retention, and disposal of personal health information.
Review vendor and business associate agreements with healthcare IT, transcription, coding, billing, and other data processors for explicit requirements covering multi-factor authentication, credential management, encryption, security monitoring and alerting, incident response, and prompt breach notification. Data processing and business associate clauses should specify safeguards for protected health information, annual risk assessments, and limits and procedures for collection, use, retention, and secure disposal. Review customer agreements to clarify security responsibilities and notification obligations, and employee access policies and agreements for remote-access controls and credential protection.
Entity
Perry Johnson & Associates, Inc.; Perry Johnson, Inc.; Perry Johnson & Associates Coding, Inc.; Perry Johnson & Associates Radiology, Inc.; and Medical Transcription and Coding, Inc.
Industry
TechnologyOfficial Press Release
https://ag.ny.gov/press-release/2026/attorney-general-james-secures-10-million-and-critical-reforms-companies-failed
perry johnson associates inc et al assurance of discontinuan
https://ag.ny.gov/sites/default/files/settlements-agreements/perry-johnson-associates-inc-et-al-assurance-of-discontinuance-2026_0.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc."
"Up to $10 Million"
"will pay at least $300,000 in penalties to the coalition. If the companies fail to meet the terms of the agreement, they will be liable to pay an additional $9,700,000 to the states."
"Implementing annual risk assessment programs consistent with HIPAA;"
"Over the following months, hackers harvested passwords and accessed unencrypted files that contained personal and protected health information."
"At the time, PJ&A did not require users to use multi-factor authentication when remotely accessing the company’s systems."
$10.0M
A March 2023 breach exposed personal and protected health information belonging to more than 13.3 million people after hackers accessed the companies’ systems, including unencrypted files, and security alerts were not properly configured. The companies agreed to pay at least $300,000 in penalties, with up to $9.7 million more due if they fail to comply, and to implement extensive security, incident-response, and data-handling reforms.
$10.0M
A March 2023 breach at the Perry Johnson companies exposed personal and protected health information belonging to more than 13.3 million people. The companies agreed to pay at least $300,000 in penalties, with an additional $9.7 million payable if they fail to meet the agreement, and to implement security, incident-response, and data-handling reforms.
New York Attorney General James and Governor Hochul announced guidance advising county executives and sheriffs that they must end agreements to house or detain people for federal civil immigration violations by November 25, 2026. The Local Cops, Local Crimes Act makes those agreements void and unenforceable after the deadline; no monetary penalty or specific enforcement order is announced.
New York Attorney General Letitia James issued a consumer alert warning federal student loan borrowers that consolidating loans after changes under the One Big Beautiful Bill Act may limit repayment options and forgiveness eligibility. This is consumer guidance, not a privacy enforcement action; the release announces no fine or enforcement remedy.
$500K
New York Attorney General Letitia James secured a settlement with Bloomberg L.P. after finding that Bloomberg News failed to clearly disclose subscription price increases and automatic renewals, provide required acknowledgments and renewal notices, and make cancellation sufficiently easy. Bloomberg must pay $500,000 in penalties, provide refunds to eligible subscribers, and improve its subscription disclosures and practices.
$220.0M
New York Attorney General Letitia James and a bipartisan coalition secured a $220 million settlement from General Motors LLC for selling drivers’ personal driving and location data to data brokers without adequate disclosure or consent. GM must limit the driving data it collects and implement privacy assessments and dealership oversight and training.