HARTFORD, Conn. — Connecticut Attorney General William Tong and the attorneys general of Michigan and New Jersey said Friday they had reached a settlement worth up to $10 million with a group of health care technology companies over a March 2023 data breach that exposed records tied to more than 13.3 million people, about 108,000 of them in Connecticut.

The settlement covers Perry Johnson & Associates Inc. and four related companies, which provided coding, billing and transcription services to health care organizations across the country, including in Connecticut, according to Tong's office.

Under the agreement, the companies will pay at least $300,000 in penalties to the three states and would owe an additional $9.7 million if they fail to meet its terms, the attorney general's office said. Connecticut will receive $66,666 in penalties and costs.

According to the states' investigation, hackers got into Perry Johnson & Associates' systems in March 2023 using the login of an employee at one of the companies. The company did not require multi-factor authentication for remote access at the time, investigators found, and over the following months hackers collected passwords and reached unencrypted files.

The investigation found that the companies' software recorded the hackers' activity but was not set up to alert security staff, and that the company learned of the breach only when the hackers contacted it two months later, Tong's office said.

The exposed records included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, lab and test results and medication names, the office said.

Any of the companies that holds protected health information must now keep a comprehensive security program and incident response plan, use multi-factor authentication, encryption and password safeguards, conduct annual risk assessments under federal health privacy law, and follow rules on how such data is collected, kept and disposed of.

This brief was drafted by AI from a public agency or political press release and published by The New England Signal. Why we use AI for stories like this one.