Connecticut Attorney General William Tong joined the attorneys general of Michigan and New Jersey in a settlement of up to $10 million with Perry Johnson & Associates and four affiliated companies over a 2023 data breach that exposed the medical information of approximately 107,960 Connecticut residents.  Perry Johnson & Associates provided coding, billing and recording services to health care organizations. The March 2023 breach affected 13.3 million people nationwide.

The coalition’s investigation found that hackers accessed the company’s systems with an employee’s credentials when remote access did not require multi-factor authentication, and that monitoring software recorded the activity but was not configured to alert security personnel. The company learned of the breach when the hackers contacted it two months later. The exposed records included names, Social Security numbers, diagnoses and insurance information.

Tong said: “As a result of Perry Johnson companies’ inadequate security measures, hackers were able to get their hands on protected health information for millions of Americans. This settlement includes strong new protections to ensure personal information is secure going forward. Companies have a responsibility to safeguard sensitive information, and we will not hesitate to hold them accountable when they fail to do so.”

The companies will pay at least $300,000 in penalties and owe another $9.7 million if they fail to meet the agreement’s terms. Connecticut will receive $66,666 in penalties and costs.

Any company that maintains protected health information must keep an information security program and incident response protocol, use multi-factor authentication, encryption and password management safeguards, conduct annual risk assessments consistent with HIPAA, and maintain policies governing the retention and disposal of personal health information.