The Perry Johnson & Associates (PJ&A) settlement has sparked significant discussion among compliance teams. A coalition of state attorneys general, led by New York Attorney General Letitia James, concluded its investigation into PJ&A and four related companies with a $10 million settlement. Most of that amount is suspended, with PJ&A paying $300,000 now and the remaining $9.7 million due if the companies fail to meet the settlement terms.
The breach exposed the data of roughly 13.3 million individuals. Here are the most common questions we hear, with direct answers.
Q1: How did attackers get in? Was it a sophisticated exploit?
No. The attacker used stolen credentials from a coding employee to access an account without multifactor authentication (MFA). From there, they harvested additional passwords and moved into other resources. The lesson is clear: the initial access wasn't sophisticated, but the missing control was basic. Audit where MFA is enforced, not just where policy dictates. Service accounts, legacy applications, and vendor-facing portals are common gaps. An MFA policy covering 95% of accounts still leaves the remaining 5% vulnerable.
Q2: We have EDR and logging in place. Doesn't that cover us on monitoring?
Not if no one is actively monitoring it. PJ&A had security software that recorded unauthorized activity but wasn't configured to generate alerts. The first confirmed access was on March 27, 2023, data exfiltration occurred between April 7 and April 19, and the company only learned of the intrusion on May 2, when attackers contacted PJ&A employees directly.
Installed isn't the same as operational. Under the HIPAA Security Rule's audit controls standard (45 CFR 164.312(b)) and the information system activity review specification (164.308(a)(1)(ii)(D)), you're expected to record and examine activity in systems containing ePHI. Test it. Run a controlled detection exercise to ensure alerts are triggered and properly triaged.
Q3: We do risk assessments every year. Isn't that enough?
This should concern you. PJ&A conducted general risk assessments but failed to perform a HIPAA risk analysis, neglecting to evaluate administrative, technical, or physical safeguards under the HIPAA Security Rule.
A generic enterprise risk assessment and a HIPAA risk analysis aren't interchangeable. The Security Rule's risk analysis requirement (164.308(a)(1)(ii)(A)) demands a thorough assessment of risks to the confidentiality, integrity, and availability of ePHI. This involves scoping every system, application, and data flow that touches ePHI, then linking identified threats and vulnerabilities to specific safeguards.
Frameworks like NIST SP 800-30 and the NIST Cybersecurity Framework (CSF) 2.0 can guide this process, but your output must map back to the Security Rule. If your assessment doesn't cite an ePHI inventory, it likely won't withstand regulatory scrutiny.
Q4: Our subcontractors only have limited access. Do we really need contracts for them?
Yes, regardless of access level. The investigation found PJ&A gave subcontractors technical access to systems containing ePHI without contractual obligations to protect that information or implement reasonable safeguards.
The Security Rule's business associate provisions (164.308(b) and 164.314(a)) require written agreements with those who create, receive, maintain, or transmit ePHI on your behalf. This includes your business associates' subcontractors. Review your vendor inventory and ensure every party with technical access to ePHI has an executed agreement. Missing agreements are violations waiting to happen.
Q5: Does the settlement mean unencrypted data is automatically a violation?
Be cautious. Encryption is an addressable specification under the Security Rule (164.312(a)(2)(iv) and 164.312(e)(2)(ii)), not a blanket requirement. Addressable doesn't mean optional. You must assess whether encryption is reasonable and appropriate, then either implement it or document why an equivalent alternative is acceptable.
In this case, the attacker exfiltrated unencrypted files containing personal and protected health information, leading to a settlement requirement for PJ&A to implement data encryption. If your risk analysis can't justify leaving ePHI unencrypted at rest, expect scrutiny from regulators. Properly encrypted data can fall outside the definition of unsecured PHI under the Health Information Technology for Economic and Clinical Health Act.
Q6: Why are state AGs involved? I thought HHS handled HIPAA.
The HHS Office for Civil Rights isn't your only enforcer. State attorneys general can enforce HIPAA, and this settlement shows them doing so alongside state law. New York, Connecticut, New Jersey, and Michigan participated, and the investigation also found violations of New York GBL § 899-aa (breach notification) and GBL § 899-bb (reasonable safeguards for consumer information).
A single incident can create exposure under federal and state regimes. Your incident response plan should include a state-law notification matrix, not just the HIPAA Breach Notification Rule timeline. Build it before you need it.
Next Steps
Start with the HIPAA Security Rule text at 45 CFR Part 164, Subpart C, and HHS's guidance on conducting a risk analysis. For structure, map your safeguards to NIST SP 800-66 and the NIST Cybersecurity Framework (CSF) 2.0. For third-party validation, the HITRUST CSF offers a healthcare-specific certification path.
Use the settlement's required measures as a checklist: a comprehensive information security program, an incident response protocol, multi-factor authentication, password management, data encryption, asset management, data retention and disposal policies, and annual risk assessments consistent with the HIPAA Rules. If you can't evidence each one today, that's your remediation backlog.
