Healthcare company faces $10M penalty over failure to protect patient data
PJ&A’s security practices clearly needed a health check.
Helathcare-ransom-attacks
Follow us
- A breach at healthcare technology company PJ&A exposed sensitive information belonging to 13.3 million patients, including 4.2 million New Yorkers.
- Attackers used an employee’s credentials to access PJ&A’s systems, which did not require multi-factor authentication for remote access.
- PJ&A’s security software recorded the hackers’ activity but failed to alert staff; the company learned of the breach after attackers contacted it.
- PJ&A agreed to pay $300,000 in penalties and make security reforms, or face up to $9.7 million in additional penalties.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Healthcare technology company Perry Johnson & Associates (PJ&A) failed to protect sensitive medical information belonging to 13.3 million patients and is now facing a settlement of up to $10 million and mandatory security reforms.
PJ&A was an IT company that provided services such as coding, billing, and recording to healthcare organizations across the country, including in New York. In this capacity, the company held personal and sensitive patient data, such as test results, medication use, and treatment plans.
In March 2023, attackers managed to log in to PJ&A’s remote desktop web application, thereby gaining access to internal systems. To do so, the attackers used an employee’s login credentials. At the time, the IT service provider didn’t require the use of multi-factor authentication (MFA) to remotely access the company’s systems.
Over the months following the initial breach, hackers scouted the network and were able to move laterally to other systems, accessing unencrypted files that contained sensitive health information of millions of patients.
The systems contained detailed patient records, such as names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical information from medical transcription files, such as laboratory and diagnostic testing results and medication names.
An investigation found that PJ&A’s security software did identify and record the hackers’ activities, but wasn’t properly configured to send push notifications to alert security personnel. The company learned of the data breach only when the attackers contacted it two months later.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
According to New York State Attorney General Letitia James, the data breach affected 13.3 million individuals, including 4.2 million New Yorkers.
James, along with the Attorneys General of Connecticut, Michigan, and New Jersey, and PJ&A have agreed to pay $300,000 in penalties to these states.
In addition, the tech company is required to maintain robust security and retention policies and practices. Failing to do so may result in an additional $9.7 million in penalties to the states.
“Your health is your business, and companies entrusted with personal health information have a duty to rigorously protect it. PJ&A failed its basic responsibility to guard patients’ data, leading to the exposure of millions of New Yorkers’ private information. As a result of our investigation, PJ&A will make critical changes to protect patients’ data to ensure a data breach like this one does not happen again,” Attorney General James said in a statement.
