States Reach $10M Settlement With Health IT Vendor Over Data Breach

New York Attorney General Letitia James announced a settlement of up to $10 million on Nov. 6 with health IT vendor Perry Johnson & Associates and four affiliated companies, resolving claims from attorneys general in New York, Connecticut, Michigan and New Jersey over a 2023 data breach that exposed information on more than 13.3 million people. Hackers accessed the company's systems in March 2023 using an employee's credentials; the company lacked multifactor authentication and did not discover the breach until contacted by the attackers two months later. Compromised data included names, Social Security numbers, diagnoses, insurance information and clinical test results. Affected health systems included Cook County Health and Northwell Health. The settlement requires at least $300,000 in penalties and costs, with an additional $9.7 million owed if the companies fail to comply with required cybersecurity reforms including multifactor authentication, encryption and annual HIPAA-consistent risk assessments.