PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law

A $10 million settlement has been agreed to resolve a multi-state investigation of the medical transcription service provider Perry Johnson & Associates, Inc. (PJ&A) and four related companies. The investigation identified multiple violations of the HIPAA Security Rule and state laws.

While the settlement could see a financial penalty of $10 million paid, the vast majority of the penalty has been suspended. PJ&A is required to pay $300,000 in penalties and must adopt and maintain robust data security policies and practices. Should the PJ&A companies fail to meet the terms of the settlement agreement, they will be liable to pay the remaining $9.

7 million to the participating states. PJ&A, a health information technology company that provides medical transcription, coding, and billing services to hospitals and other healthcare providers, experienced a cybersecurity incident in March 2023. A threat actor compromised its network using the credentials of a PJ&A employee and accessed parts of its network containing the electronic protected health information of approximately 13.

3 million individuals. The forensic investigation determined that its network was first accessed by the threat actor on March 27, 2023, and that between April 7 and April 19, 2023, database files containing patient information were exfiltrated, including names, addresses, dates of birth, Social Security numbers, diagnoses, health insurance information, and information contained in transcription files, including lab test results and medications.

The intrusion was detected on May 2, 2023, when the hackers started contacting PJ&A employees directly. A ransom payment was demanded to prevent the publication of the stolen data, and when payment was not made, the stolen data was leaked. An investigation was launched by a coalition of state attorneys general to determine whether the data breach occurred as a result of the failure to comply with federal and state laws.

The investigation was led by New York Attorney General Letitia James, and Connecticut Attorney General William Tong, New Jersey Attorney General Jennifer Davenport, and Michigan Attorney General Dana Nessel participated in the investigation. Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form.

Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy The investigation determined that the threat actor was able to use the stolen credentials of a coding employee to access an account that did not have multifactor authentication enabled. After gaining access to PJ&A systems, the threat actor harvested passwords over the following months to access further resources and exfiltrated unencrypted files containing personal and protected health information.

The intrusion was only detected when the hackers made contact two months after the initial compromise. PJ&A had security software installed that recorded the unauthorized activity; however, it was not configured to generate alerts, so the intrusion went unnoticed. The multi-state investigation determined that while PJ&A conducted general risk assessments, it failed to conduct a HIPAA risk analysis and did not conduct or evaluate the companies’ administrative, technical, or physical safeguards in the context of the HIPAA Security Rule requirements.

PJ&A failed to comply with the HIPAA Security Rule with respect to the use of subcontractors, which were provided with technical access to systems containing ePHI without being contractually obliged to ensure the confidentiality of ePHI or implement reasonable safeguards to protect that information. The investigation also identified a further 16 violations of the HIPAA Security Rule, and violations of New York regulations GBL § 899-aa and GBL § 899-bb.

The former relates to issuing data breach notifications in the most expedient time possible, and the latter relates to the implementation and maintenance of reasonable safeguards to protect consumer information. The settlement agreement was agreed by the participating states, PJ&A, and the associated companies Perry Johnson, Inc. , Perry Johnson & Associates Coding, Inc.

, Perry Johnson & Associates Radiology, Inc. , and Medical Transcription and Coding, Inc. New York will receive $100,000 of the $300,000 penalty, and Connecticut, New Jersey, and Michigan will each receive $66,666.

Under the terms of the settlement agreement, PJ&A is required to implement and maintain robust data security policies and procedures. These include implementing and maintaining a comprehensive information security program and incident response protocol; multi-factor identification; password management; data encryption; and asset management safeguards and policies.

Policies and procedures must be implemented governing the collection, use, retention, and disposal of personal health information, and annual risk assessments should be conducted consistent with the HIPAA Rules. The post PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law appeared first on The HIPAA Journal .