Perry Johnson Data Breach Settlement: $10M, 13.3M [2026]

Four state attorneys general announced a Perry Johnson data breach settlement this week that carries a $10 million headline but only $300,000 in penalties due up front. According to Beinsure, the deal covers a March 2023 breach that touched records tied to 13.3 million individuals nationwide. New York Attorney General Letitia James led the announcement alongside her counterparts in Connecticut, Michigan and New Jersey.

The gap between $10 million and $300,000 is the whole story. The remaining $9.7 million is suspended, which means it becomes payable only if the companies fail to meet the agreement’s terms. That structure shifts the real weight of the deal from the fine to the security program the companies must now build and prove.

This analysis walks through the settlement terms, the state-level numbers, the required technical controls and the broader enforcement picture. It also lays out what the deal signals for medical transcription vendors and the hospitals that hire them. If you track public-sector exposure too, our earlier piece on the Sussex County prosecutor breach shows how slowly disclosure details tend to surface.

Perry Johnson Data Breach Settlement: What the States Announced

The agreement resolves a multistate investigation into five related companies. New York’s filing, posted by the attorney general’s office as an assurance of discontinuance, names Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc. and Medical Transcription and Coding, Inc. All five fall under the same set of obligations.

The headline figure reads up to $10 million, and the word up matters. The states secured at least $300,000 in penalties. An additional $9.7 million sits in suspension and triggers only on a breach of the agreement’s terms. Anyone quoting the deal as a flat $10 million payment is overstating what the companies owe today.

The official materials also ask the companies to maintain information-security, incident-response and data-retention policies and practices. That language sounds routine, but the details behind it are specific, and we cover them below. The announcement did not include an on-record quotation we could verify from a named speaker, so this article paraphrases the states’ positions and attributes them to the outlets that reported them.

Why $10 Million Really Means $300,000 Today

Suspended penalties work like a probation clause. The money exists on paper, the companies know it exists, and a regulator can collect it if the companies slip. Recording Law framed the deal in exactly those terms, pairing the $10 million headline with the $300,000 actually due.

Simple arithmetic puts the cash portion in perspective. Spread across 13.3 million individuals, $300,000 works out to roughly 2.3 cents each. Even the full $10 million equals about 75 cents per person. These are our own calculations and they do not describe a payout. The states announced penalties and reforms, and the sources we reviewed do not describe any per-person payment to affected individuals.

The 3% versus 97% split tells you where regulators placed their leverage. A large cash fine against a mid-sized vendor can push it into insolvency, which leaves nothing to fund the very security fixes the states want. A small fine plus a large contingent penalty keeps the company operating and keeps a heavy incentive in place.

Five Companies, One March 2023 Breach

The breach dates to March 2023, which means the settlement arrives more than three years after the incident. That timeline is typical for multistate privacy cases. Investigators need to gather evidence from several jurisdictions, negotiate terms with defense counsel and agree on a common set of obligations before four offices can announce together.

The five named entities suggest a corporate family rather than a single firm. PJ&A and PJI sit at the center, with separate coding and radiology units and a medical transcription and coding company alongside them. The agreement treats them as a group, so a failure by one affiliate can put the suspended penalty at risk for the others. We cannot say from the available sources how the entities relate to each other internally, so we stick to the names the states listed.

Medical transcription is a quiet corner of healthcare IT. Physicians dictate notes, the vendor converts them into text, and the finished records flow back into the hospital’s systems. Every step creates a copy of sensitive data outside the hospital’s own walls. When a vendor in that chain gets breached, the hospitals that hired it often learn about it second-hand, and their patients learn about it from a letter.

13.3 Million Individuals, State by State

The 13.3 million figure counts individuals whose records were associated with the affected files. It does not necessarily mean 13.3 million separate patients, and the sources do not break the number down that way. We use the word individuals throughout for that reason.

New York carries the largest single share. Finger Lakes 1 reported that about 4.2 million New Yorkers were affected, which is roughly 32% of the national total. New Jersey follows with nearly 540,000 residents, about 4% of the total. Connecticut’s attorney general put the state’s count at approximately 107,960 in its press release, under 1%.

The three states with published counts add up to roughly 4.85 million people, or a little over a third of the national figure. That leaves more than 8 million individuals in states outside the settlement or in Michigan’s undisclosed count. Residents of non-participating states are not covered by this specific agreement, though the reforms it imposes apply to the companies’ operations generally.

Scale puts this case in a different class from many breaches we have covered. When Mirae Asset’s breach hit 35,255 staff and 3,800 clients, the exposure ran to tens of thousands. The Perry Johnson files involved records tied to a population roughly 300 times larger than that combined figure.

What the Official Materials Say About the Exposed Data

State materials describe the compromised files as containing personal and medical information connected to the affected individuals. That is the extent of what the sources confirm. They do not list specific data fields in the text we reviewed, and we will not guess at them.

Readers should resist filling the gap with assumptions. Reports about healthcare breaches often list Social Security numbers, diagnoses and insurance details because earlier incidents involved them. For this one, the fair reading is narrower. The states say personal and medical information was in the files, and any reader who wants the exact fields should check the notice letter or the attorney general’s filing directly.

The category still carries real risk for individuals. Medical information cannot be reissued the way a credit card number can. A person whose diagnosis or treatment history leaks cannot cancel it, and that permanence is a core reason regulators treat healthcare breaches more seriously than most consumer data incidents.

The Security Reforms the Companies Must Adopt

The reform package is where the agreement bites. According to Beinsure’s reporting on the terms, the companies must run documented information-security and data-retention programs that include annual risk assessments plus administrative and technical safeguards. The list of technical controls reads like a baseline hardening checklist.

Required technical controls

• Multifactor authentication and stronger password controls
• Encryption of sensitive data
• Network segmentation to limit lateral movement
• Centralized logging with automated alerts for suspicious activity
• Intrusion detection and prevention systems
• Endpoint detection and response (EDR) tooling
• Annual penetration testing

Several items on that list depend on each other. Centralized logging only helps if someone reads the alerts, which is why teams pair it with a security information and event management platform. Our SIEM tools comparison covers how Splunk, Sentinel and others handle that job. The annual penetration testing requirement similarly pairs with tooling covered in our penetration testing tools roundup.

Oversight and verification

The agreement does not rely on the companies’ word alone. Per Beinsure, the companies must appoint qualified information-security officers and deliver recurring privacy and security training. They must also complete independent security assessments within 90 days of becoming active and then annually for three years, and they must keep the assessment records for six years.

The 90-day clock tied to becoming active hints that some of the entities may not currently be operating. The reporting we reviewed does not explain that point, so we flag it as an open question rather than a finding. The six-year retention window matches the standard HIPAA documentation period, which gives future investigators a clean paper trail.

How State Attorneys General Enforce Healthcare Privacy

Federal enforcement of the HIPAA Privacy, Security and Breach Notification Rules sits with the Department of Health and Human Services’ Office for Civil Rights. State attorneys general hold concurrent power to enforce HIPAA in their residents’ interest and can also bring cases under their own consumer protection and data security laws. Perry Johnson shows what happens when several states combine those tools in a single negotiation.

Multistate deals offer defendants one advantage. A single agreement resolves exposure in all participating states at once, which beats fighting four separate investigations. States gain too. They share investigative costs and agree on one set of reforms that no single office could easily impose on a company headquartered elsewhere.

For global readers, the contrast with European regimes is useful. Under GDPR, regulators can levy percentage-of-turnover fines, and incident reporting runs on short clocks. Our breakdown of NIS2 vs DORA vs GDPR sets those caps against the US approach, where penalties tend to be negotiated and often suspended, as they are here.

Healthcare Breach Settlements Compared

The research pulled for this article surfaced several recent healthcare enforcement and litigation outcomes. We list them with the outlet that reported each one and treat the figures as reported, not independently confirmed. Dates and amounts come from those summaries, so check the originals before citing them elsewhere.

The Yale New Haven figure stands out. A single private class settlement reportedly reached $18 million, which exceeds the maximum Perry Johnson exposure to four states and dwarfs OCR’s entire 2025 enforcement total of $8,330,066. Regulators set the rules, but plaintiffs’ lawyers often set the bill.

The Labcorp case offers the closest structural parallel, since it also involved a third-party vendor and a long multistate negotiation. The reforms listed there included a qualified security officer, vendor risk management, penetration testing and SOC 2 Type 2 or HITRUST assessments. The overlap with the Perry Johnson terms suggests state offices are converging on a shared template.

Private Litigation Runs on a Separate Track

The breach also produced private lawsuits, including proposed class actions that accuse the companies of failing to protect sensitive personal and medical information. The state announcements do not establish a final class judgment or a separate class settlement. We could not find a court docket in the sources we reviewed, so we cannot say where those cases stand.

That separation matters for affected individuals. The attorneys general settled on behalf of the states, and the sources describe penalties and reforms rather than compensation to residents. Anyone hoping for a check from this agreement should read the original documents closely before assuming one exists. If a class settlement emerges later, it would come with its own notice and claims process.

The two tracks also interact. Defendants who agree to independent assessments and reforms with regulators can point to that work in court, and plaintiffs can use the same documents to argue the original security was inadequate. Lawyers on both sides will read the assurance of discontinuance with that dual use in mind.

Why Transcription and Coding Vendors Sit in the Blast Radius

Under HIPAA, vendors that handle patient data for a hospital or clinic count as business associates. They owe the same Security Rule duties as the providers who hire them. In practice, vendors often run leaner security teams than the hospitals they serve, and attackers know it.

Concentration risk amplifies the problem. One transcription firm can serve many health systems at once, so a single compromise reaches records from many organizations. The 13.3 million figure illustrates the effect. No single hospital holds that many patients, but one vendor can.

Health systems are responding with tighter identity controls. Our look at One Identity Identity Manager 10.0 covers one product aimed at risk-scored access after a year of credential-led breaches. Vendor access reviews, contract security schedules and breach-notice deadlines are all moving from nice-to-have to required in procurement.

Market and Compliance Impact for Healthcare IT

OCR’s recent enforcement has stressed missing or inadequate risk analyses. The CIS summary of regulator priorities cited in our research notes four ransomware-related OCR settlements in April 2026 totaling more than $1.1 million, with absent risk analysis a common thread. The Perry Johnson agreement reinforces the same message at the state level by mandating annual risk assessments.

For vendors, the compliance bill rises. Mandating EDR, centralized logging, segmentation and independent assessments for three years adds licensing, staffing and audit costs. Small transcription and coding shops may find the cost of a SOC 2 or HITRUST assessment hard to carry, and some will merge or exit. Larger platforms with mature security programs gain a selling point.

Cyber insurers will watch these terms too. A list of explicit regulator-approved controls gives underwriters a ready-made questionnaire. Expect more renewal applications to ask whether a vendor meets the same baseline, and expect premiums to track the answer. For wider coverage of these trends, see our cybersecurity category.

Five Predictions for Vendor Breach Enforcement

These are our own forecasts based on the pattern in this case and the comparable deals above. They are analysis, not reporting, and none of them comes from the attorneys general.

1. Suspended penalties will spread. Expect more multistate deals that pair a small upfront payment with a large contingent sum, because the structure keeps vendors solvent and compliant.
2. Control lists will get longer and more specific. Naming EDR, segmentation and penetration testing in an agreement sets a floor that later settlements will copy and extend.
3. Contracts will absorb the reforms. Hospitals will write the same controls into vendor agreements, so compliance will start to arrive through procurement before it arrives through enforcement.
4. Private suits will stay the larger cost. The reported $18 million Yale New Haven class settlement shows the pattern, and vendor defendants will keep paying more to plaintiffs than to regulators.
5. Risk analysis will remain the first thing auditors ask for. OCR’s emphasis on missing risk analyses and the annual assessment mandate here point the same direction.

What Patients and Security Teams Should Do Now

Individuals who received a notice about this breach should keep the letter and watch their explanation-of-benefits statements for services they did not receive. A credit freeze costs nothing and blocks new accounts opened in your name. Because the sources describe medical information in the files, medical identity theft deserves a specific look, so review insurer statements monthly.

Security teams at covered entities have a clearer checklist. Audit every business associate that touches protected health information. Confirm each one has MFA, encryption, logging and a tested incident-response plan, and ask for the date of their last independent assessment. If a vendor cannot answer within a week, treat that as a finding.

The takeaway: the Perry Johnson data breach settlement is less about the money than the template. Four states have put a detailed security baseline in writing for a vendor that held records on 13.3 million individuals, and they have kept $9.7 million in reserve to enforce it.

Frequently Asked Questions

How much is the Perry Johnson data breach settlement worth?

The headline amount is up to $10 million. The companies owe at least $300,000 in penalties now, and the remaining $9.7 million is suspended and becomes payable only if they fail to meet the agreement’s terms.

Which states reached the settlement?

New York, Connecticut, Michigan and New Jersey. New York Attorney General Letitia James announced the deal together with the attorneys general of the other three states.

How many people were affected?

The agreement cites 13.3 million individuals nationwide, with about 4.2 million in New York, nearly 540,000 in New Jersey and about 107,960 in Connecticut. The figure counts individuals whose records were associated with the affected files, not necessarily 13.3 million distinct patients.

When did the breach happen?

The breach occurred in March 2023. The settlement came more than three years later after a multistate investigation.

Will affected individuals receive a payment?

The sources we reviewed describe penalties paid to the states and required security reforms. They do not describe a per-person payment. Separate private class actions exist, but the state announcements do not establish a final class settlement.

Which companies are covered?

Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc. and Medical Transcription and Coding, Inc.

What security changes does the agreement require?

According to Beinsure, the companies must adopt multifactor authentication, stronger passwords, encryption, network segmentation, centralized logging with automated alerts, intrusion detection and prevention, endpoint detection and response, and annual penetration testing. They must also appoint qualified security officers, train staff and complete independent assessments annually for three years.

What should I do if my records may have been involved?

Keep any breach notice, review insurer statements for unfamiliar services, and consider a free credit freeze. Check the state attorney general’s announcement for contact details, since the sources we reviewed did not list a claims portal.

Marcus Chen

Gaming & Consumer Tech Editor

Marcus Chen is a senior editor at Tech Insider, where he leads coverage of the US online gaming market, including sweepstakes and social casinos, alongside consumer technology. He evaluates operators on their published terms, licensing and RNG certifications, stated redemption policies, and corroborating independent reporting, and writes plainly about what the evidence supports. Tech Insider does not run first-party money tests and does not gamble with reader funds. Marcus has reported on the technology and online-gaming industries for more than a decade.

View all articles