Perry Johnson Associates Medical Breach: 9 Million Patient Records Stolen

Perry Johnson & Associates, a medical transcription service provider, suffered a data breach that exposed the sensitive health information of approximately 8.95 million patients. The company transcribes medical dictation for healthcare providers, giving it access to detailed patient records including diagnoses, treatment plans, medication lists, and clinical notes. The breach exposed names, Social Security numbers, dates of birth, medical record numbers, hospital account numbers, and clinical information from medical transcriptions. Because PJ&A operates as a business associate to healthcare providers under HIPAA, the breach cascaded across multiple hospitals and health systems, each of which had to notify their own patients. Major health systems including Northwell Health and Cook County Health were among those affected. The incident highlighted supply chain risks in healthcare where business associates handle sensitive patient data but may have weaker security than the healthcare providers they serve.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.