Vendors Face Security Rules After Patient Data Breach

The settlement covers 4.2 million New Yorkers and carries up to $9.7 million in added exposure if companies fail to comply.

Updated on Nov. 6, 2026 in Cybersecurity

Vendors Face Security Rules After Patient Data Breach

Live Poll

Do you trust companies that hold your medical records to keep them secure?

New York Attorney General Letitia James announced a multistate settlement with five medical transcription and coding companies, including Perry Johnson & Associates Inc., over a March 2023 data breach. The agreement requires data security improvements and at least $300,000 in payments; the development is an enforcement settlement, not a new technology.

Why it matters

The case shows how a single compromised employee credential, combined with a remote-access system lacking multifactor authentication, can expose millions of medical records held by third-party vendors rather than hospitals themselves. It signals that state attorneys general are pursuing vendors in the health data supply chain for security lapses.

The settlement is a multistate enforcement agreement covering 4.2 million New Yorkers within a national breach of 13.3 million people, with at least $300,000 in payments and a potential additional $9.7 million if the companies fail to meet its terms. The filing does not specify how compliance with the required security improvements will be verified.

The players

Letitia James

New York Attorney General who announced the multistate settlement with the five companies.

Perry Johnson & Associates Inc.

Medical transcription company whose software recorded activity but lacked alerts for suspicious behavior, and which is among the five companies covered by the settlement.

The details

Hackers used the login credentials of a coding employee to enter a remote-access system that lacked multifactor authentication, which normally requires a second form of verification beyond a password. Once inside, they collected additional passwords stored in unencrypted files and used them to reach more systems. Perry Johnson Inc. had software that logged activity, but it had not been configured to send alerts for suspicious behavior, and the companies learned of the intrusion roughly two months later, when the hackers contacted them. Exposed data included names, birth dates, addresses, Social Security numbers, hospital account information, diagnoses, insurance details, laboratory and test results, medications, and medical transcription records.

- March 2023: Hackers breach the systems using a coding employee's credentials.
- About two months after the initial intrusion: The companies learn of the breach when hackers contact them.
- November 6, 2026: Attorney General Letitia James announces the multistate settlement.

The Tech Race

The settlement places vendor-side security in the same enforcement category as breaches at covered health entities, meaning transcription and coding firms now face the same scrutiny as their clients. It shows that multifactor authentication and alert configuration, long treated as baseline controls, are becoming the measurable standard regulators apply.

New Yorkers whose medical transcription or coding records were held by these vendors may be eligible for notice and protections tied to the breach, though the extraction does not describe any claim process. Patients should expect the companies to face ongoing compliance obligations, with the $9.7 million additional exposure serving as the stated enforcement lever.

The takeaway

Watch whether the five companies meet the security requirements, since failure would trigger up to $9.7 million in additional exposure. Vendors handling patient records should review whether remote-access systems use multifactor authentication and whether suspicious-activity alerts are configured.