Data Privacy,
Data Security,
Healthcare
Perry Johnson Firms Face Penalties, Reforms Over 2023 Hack Affecting 13.3 Million
A healthcare IT services firm, known as Perry Johnson & Associates, along with several of its affiliated companies, has reached a significant settlement involving a payment of up to $10 million. This settlement comes in response to an investigation conducted by the attorneys general of New York, New Jersey, Connecticut, and Michigan regarding a major breach that impacted the personal and health information of at least 13.3 million individuals.
The announcement, made public on Friday, indicates that the investigation uncovered serious cybersecurity failures and numerous violations of HIPAA regulations. Alleged shortcomings included a total lack of multifactor authentication for remote access, ineffective password management protocols, and a notable absence of robust encryption measures. Furthermore, the existing security monitoring software, which recorded the hackers’ activities, was unable to provide timely alerts regarding the breach.
Investigation findings highlighted various HIPAA violations. The deficiencies included a failure to conduct an adequate security risk analysis as mandated, a lack of necessary business associate agreements with affiliated firms that had access to protected health information, and shortcomings in compliance with breach notification requirements dictated by HIPAA.
Aside from Perry Johnson & Associates, the settlement encompasses several of its linked firms: Perry Johnson, Inc. (PJI); Perry Johnson & Associates Coding, Inc.; Perry Johnson & Associates Radiology, Inc.; and Medical Transcription and Coding, Inc. The agreement stipulates that the companies will pay an initial sum of $300,000, with the remaining $9.7 million being suspended unless the firms are found in violation of the settlement terms or their financial representations are proven to be significantly inaccurate, as stated by the authorities involved.
The settlement distribution will be allocated among the four states. Of those affected, approximately 4.2 million were residents of New York, about 107,960 belonged to Connecticut, and nearly 540,000 were located in New Jersey. Notably, documents pertaining to the settlement, as of the latest updates, did not disclose the number of individuals impacted in Michigan.
The nature of the compromised data varied for each individual and included sensitive information such as names, birth dates, addresses, Social Security numbers, medical record numbers, admission diagnoses, hospital account numbers, treatment dates, laboratory and diagnostic test results, and various other personal and health-related details.
Security Improvements Required
The settlement mandates substantial cybersecurity enhancements for the active companies under Perry Johnson’s umbrella. The improvements must encompass stronger access controls, the implementation of multifactor authentication systems, encryption protocols, automated alerts for security incidents, and enhanced monitoring for potential threats. Regular security assessments, penetration testing, upgraded incident response procedures, and stricter oversight of vendors with access to sensitive information are also outlined in the agreement.
A requirement for independent third-party security assessments to begin within 90 days of the settlement took effect has been established, with annual evaluations mandated for a span of three years. Additionally, the settlement necessitates written security reports to be presented to senior management and boards of directors at least bi-annually, along with measures for the secure destruction of sensitive information held by defunct firms.
Interestingly, the only company still in operation from those involved in the settlement is Perry Johnson, Inc. (PJI). According to a spokesperson for the New Jersey attorney general’s office, the other companies involved have securely disposed of all private health information (PHI) and personally identifiable information (PII), while PJI is required to protect any retained information.
Breach Details
The breach itself began in March 2023 when unauthorized access to the Perry Johnson network was achieved using compromised employee credentials linked to PJ&A Coding. The attackers were able to gain remote access through an application that did not demand multifactor authentication. Once infiltrated, the threat actors conducted extensive reconnaissance, captured further passwords, elevated their system privileges, and navigated through the various systems in order to extract database files that encompassed sensitive data relating to millions of patients.
The security inquiry further disclosed that the attackers accessed shared network files containing additional personal and health-related information. The companies’ failure to proactively review these files left the overall scope of the compromised information uncertain, according to officials overseeing the investigation.
Discovery of the breach did not occur until May 2023, when the hackers themselves contacted the firms to announce the theft of tens of thousands of files, demanding payment in exchange for the deletion of the stolen data. Follow-up investigations confirmed that database files containing patient information had indeed been exfiltrated.
Ignored Security Alerts
A concurrent multi-state investigation revealed that the companies’ existing security monitoring tools had recorded the hackers’ malicious actions but had failed to issue any alerts that might have notified security personnel of the ongoing breach. Disturbingly, it was uncovered that in February 2022, over a year prior to when the breach was officially recognized, an administrator at PJ&A requested that email alerts from the security software be activated. However, this request was never acted upon.
Moreover, although the security software recorded malicious activity commencing on March 29, 2023, PJI and PJ&A had configured the system incorrectly, resulting in a lack of awareness regarding the attack.
Further investigation revealed that password management was seriously deficient. Nine employee accounts utilized nearly identical passwords that varied only by a single digit, and these credentials were shared via email, erroneously including one message sent to an external party. Alarmingly, the passwords had not been updated for approximately 10 months, despite corporate policy stipulating that changes were required every 90 days.
In conclusion, although the companies neither admitted nor denied the findings as part of the settlement, the repercussions of the breach are still unfolding. Perry L. Johnson, the owner of the involved firms, had not responded to requests for commentary regarding the settlement at the time of reporting. Additionally, a federal investigation pertaining to the incident is ongoing, and several civil class action lawsuits related to the hack are pending.