Settlement with four states after 2023 breach at medical transcription and imaging services

What happened and what to do

The Record article reports that the attorneys general of Connecticut, New Jersey, New York and Michigan reached a settlement tied to the 2023 breach against medical transcription, coding and imaging subsidiaries of Perry Johnson Companies, based in Nevada. The breach affected sensitive medical records, and the case was brought by the four states.

For companies that process or outsource clinical data, the case shows that risk also sits with vendors and the processing chain. In practice, the response starts with an inventory of which data goes to third parties, segmented access controls across transcription and imaging workflows, access logging with alerts for unusual export volumes, periodic recovery tests, and an incident response plan with state-by-state notification deadlines. A monitoring pipeline that brings access logs from all vendors into a single dashboard can shorten detection time, and contract reviews with audit rights and minimum retention clauses complete the protection.

How the consultancy can help

Wendelmaques can diagnose exposure to clinical data vendors by mapping data flows, access and retention periods, and design a scoped solution with access monitoring, alerts, dashboards and incident response routines, deployed on the client's infrastructure and operated under a monthly contract.

Next step

Send a short description of your case, including the vendors handling clinical data and the systems involved, and receive a scoped proposal to assess and reduce this risk.