Multistate AG Coalition Reaches $10 Million Settlement with Perry Johnson & Associates Over 13.3 Million-Record Medical Transcription Breach

A single missing document, a completed and documented risk analysis, reportedly sat at the center of a breach that exposed the protected health information of roughly 13.3 million patients and ultimately cost Perry Johnson & Associates and four affiliated entities $10 million.

New York Attorney General Letitia James announced the multistate settlement on or around November 8, 2026, following an investigation into Perry Johnson & Associates (PJ&A), a company that provides medical transcription and coding services to healthcare clients as a HIPAA business associate. The coalition of state AGs found that PJ&A failed to perform a required HIPAA risk analysis before the breach occurred and violated multiple provisions of the HIPAA Security Rule and Breach Notification Rule.

What Happened

PJ&A operates as a business associate under HIPAA, meaning it handles protected health information on behalf of covered healthcare entities without itself being a hospital, clinic, or insurer. The breach reportedly affected approximately 13.3 million patients, making it one of the largest medical transcription breaches on record.

Investigators from the multistate coalition concluded that PJ&A had not conducted the foundational security review that HIPAA requires of every covered entity and business associate. The risk analysis obligation is spelled out explicitly in the Security Rule: 45 CFR §164.308(a)(1). That provision requires organizations to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.

Failing to complete that analysis is not simply an oversight. It means an organization cannot know which controls to implement, which gaps to close, or how to prioritize remediation. Every downstream Security Rule requirement rests on the foundation of a completed risk analysis.

Investigators also cited violations of the Breach Notification Rule, which governs how and when covered entities and business associates must report breaches to affected individuals, the media in certain cases, and the Secretary of HHS. The relevant notification obligations for business associates are addressed under 45 CFR §164.410.

Why State AGs Are Enforcing HIPAA

A detail compliance officers should not overlook: this settlement came from a coalition of state attorneys general, not from the HHS Office for Civil Rights. HIPAA grants state AGs the authority to bring civil actions on behalf of state residents for violations of the HIPAA Privacy and Security Rules. The settlement with PJ&A is a reminder that federal OCR enforcement is not the only channel through which HIPAA obligations can be tested and penalized.

The multistate structure of this action also amplifies its reach. When a single breach touches patients across many states, multiple AGs may coordinate, increasing investigative resources and collective leverage in settlement negotiations.

The Corrective Security Program

In addition to the $10 million financial settlement, PJ&A and its four affiliated medical transcription and coding entities must implement a comprehensive corrective security program under the agreement. The specific requirements of that program were not detailed in available reporting, but corrective programs in settlements of this type typically include elements such as formal risk analysis and risk management processes, employee training, enhanced access controls, audit controls, and ongoing monitoring and reporting obligations.

The Security Rule provisions most directly relevant to those categories include risk management under 45 CFR §164.308(a)(1), workforce training under 45 CFR §164.308(a)(5), access control standards under 45 CFR §164.312(a)(1), and audit controls under 45 CFR §164.312(b).

What This Means for Business Associate Oversight

For compliance officers managing BA relationships, this settlement reinforces several obligations that frequently slip in practice.

First, business associate agreements must require BAs to conduct and maintain documented risk analyses. A BAA that simply recites compliance obligations without requiring evidence of an active security program provides limited protection when a breach occurs.

Second, covered entities should consider including BA security posture as part of their own vendor management reviews. HIPAA does not require covered entities to audit every BA continuously, but a reasonable and appropriate risk management program, as required under 45 CFR §164.308(a)(1), should account for the risk introduced by third parties handling ePHI.

Third, the scale of this breach illustrates the concentration risk that medical transcription and coding vendors present. A single BA serving many healthcare clients can expose millions of patient records in a single incident. Covered entities should understand how much ePHI each BA holds, what the data retention practices are, and what security controls are in place.

A Note on Enforcement Characterization

This action is a state AG multistate settlement, not an OCR civil money penalty or resolution agreement. No separate OCR enforcement action against PJ&A was described in available reporting. The $10 million figure reflects the multistate settlement amount. Compliance officers should monitor both OCR and state AG channels for any further action related to this breach.