Medical Coding Firms Settle Over 2023 Data Breach
Five companies agreed to multistate terms requiring security improvements and at least $300,000 in payments after a breach exposing New Yorkers' records.
Updated on Nov. 6, 2026 in Cybersecurity
Live Poll
Do you trust companies that hold your medical records to keep them secure?
Five medical transcription and coding companies agreed to a multistate settlement requiring data security improvements and at least $300,000 in payments. The settlement follows a March 2023 hack that exposed records of about 4.2 million New Yorkers.
Why it matters
The breach exposed Social Security numbers, diagnoses and insurance details, putting New York residents at risk of identity theft and medical fraud. The case highlights how weak access controls and delayed detection can expose sensitive health information for months.
The settlement sets a minimum of $300,000 in payments, with $100,000 of initial payments going to New York for penalties and costs, while about 4.2 million New Yorkers were affected out of 13.3 million nationwide. It is unclear whether the companies will meet the agreement's terms, which could trigger an additional $9.7 million requirement.
The players
Letitia James
Letitia James is the New York Attorney General who announced the multistate settlement with the medical transcription and coding companies.
Perry Johnson & Associates Inc.
Perry Johnson & Associates Inc. is a medical transcription company whose software recorded suspicious activity but was not configured to send alerts, and is one of five companies covered by the settlement.
The details
Hackers used a coding employee's credentials to enter a remote-access system that lacked multifactor authentication, then collected additional passwords stored in unencrypted files to reach more systems. The companies learned of the breach about two months after the initial intrusion, when the hackers contacted them. Exposed data included names, birth dates, addresses, Social Security numbers, hospital account information, diagnoses, insurance information, laboratory results, medications and medical transcription records.
Timeline
March 2023: Hackers breach the companies' systems using a coding employee's credentials.
About two months after the intrusion: The companies learn of the breach when hackers contact them.
November 6, 2026: Attorney General Letitia James announces the multistate settlement.
Big Picture
The settlement follows a pattern of state attorneys general using multistate coalitions to enforce data security duties against healthcare vendors, extending that enforcement to medical transcription and coding firms. It shows regulators targeting the third-party businesses that handle patient records rather than only hospitals and insurers.
New Yorkers whose records were exposed should watch for unexpected medical bills, insurance notices or identity theft attempts using their Social Security numbers. Checking credit reports and monitoring medical statements can help catch misuse early.
The takeaway
Healthcare providers and their vendors should require multifactor authentication on remote access and configure alerts for suspicious activity. Patients can reduce risk by monitoring credit reports and reviewing medical and insurance statements for unfamiliar charges.
Further reading
Explore more New York cybersecurity coverage to see how regional regulators are responding to healthcare data threats.
Source note: This article includes information reported by Fingerlakes1.
Live Poll
Do you trust companies that hold your medical records to keep them secure?
