One of the strongest arms of HIPAA enforcement doesn’t come from the HHS Office for Civil Rights (OCR). Instead, state attorneys general have repeatedly stepped in to investigate major HIPAA breaches.

The latest example came on November 6, when the attorneys general of New York, New Jersey, Connecticut, and Michigan announced a settlement with Perry Johnson & Associates (PJ&A) and four affiliated companies regarding a 2023 breach that exposed the records of 13.3 million people. The states alleged HIPAA violations, and OCR was not involved.

The potential fine is up to $10 million: $ 300,000 is to be paid immediately; the remaining $9.7 million is suspended unless the PJ&A violates the settlement’s terms or its financial representations are found to be materially inaccurate.

Can States Enforce HIPAA?

Yes. The federal government originally had sole responsibility for HIPAA enforcement. The HITECH Act of 2009 changed that by authorizing state attorneys general to bring civil actions in federal court on behalf of their residents to stop HIPAA violations and recover damages.

There are limits. A state must give HHS written notice before filing; HHS can intervene, and a state can’t bring a HIPAA claim for a violation HHS is already pursuing. Federal damages are also modest: up to $100 per violation, capped at $25,000 per year for violations of the same requirement. That’s one reason state attorneys general rarely rely on HIPAA alone. They typically pair it with state consumer protection and data security laws, which can carry larger penalties. Most cases, including this one, end in a negotiated settlement rather than a trial.

Other notable state attorney general HIPAA investigations and settlements include:

• LabCorp in 2026, $2.3 million
• Blackbaud in 2023, $49.5 million
• Anthem in 2020, $48 million

You can find a list of 10 recent state attorney general settlements with more details here.

What Happened at PJ&A

PJ&A provided medical transcription, coding, and billing services to healthcare organizations nationwide, making it a HIPAA business associate. According to the Connecticut Attorney General’s office, in March 2023, hackers accessed PJ&A’s systems using the credentials of an employee at one of its affiliated companies. At the time, PJ&A didn’t require multi-factor authentication for remote access.

Over the following months, the hackers harvested passwords and accessed unencrypted files containing personal and health information. The states found that security software had logged the hackers’ activity, but it wasn’t configured to send alerts. PJ&A learned of the breach only when the hackers contacted the company about two months later.

The exposed records included names, birth dates, addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical details from transcription files, such as lab results and medication names. About 4.2 million of those people live in New York.

What the States Alleged

According to reporting on the settlement, the investigation focused on three HIPAA failures:

• An inadequate security risk analysis. PJ&A allegedly never thoroughly assessed the risks to the health information it held.
• Missing business associate agreements. The affiliated firms with access to protected health information allegedly lacked the required agreements.
• Breach notification deficiencies.

The states also alleged violations of New York data security and breach notification laws. As is common in these settlements, the companies neither admitted nor denied the allegations.

Reading the Dollar Amount Carefully

The settlement is valued at up to $10 million, but only $300,000 is payable now. The companies owe the remaining $9.7 million only if they violate the agreement or if the New York Attorney General finds that the financial information supporting the suspension was inaccurate. New York receives $100,000 of the upfront payment, Connecticut receives $66,666, and the remaining $200,000 is split among Connecticut, New Jersey, and Michigan.

Reports also note that only one of the named companies, Perry Johnson, Inc., remains in operation. That helps explain why the structure leans more heavily toward required changes than toward payment.

Those required changes are significant. Any Perry Johnson company that handles protected health information must:

• Maintain a written information security program and incident response plan.
• Use multi-factor authentication, password management, and encryption, and keep track of its systems and devices.
• Conduct annual security risk assessments.
• Follow written policies for how health information is collected, used, stored, and disposed of
• Undergo independent third-party security assessments, starting within 90 days of becoming active and continuing annually for three years.

What This Case Teaches

• OCR isn’t the only regulator. State attorneys general have their own priorities, staff, and state laws. They can also work together, as these four did, which multiplies the reach of a single investigation. An organization with patients in many states could face scrutiny from several of them at once.
• Business associates are squarely in the frame. PJ&A was a vendor, not a hospital. Vendors that handle health information have the same core obligations as the organizations they serve.
• The alleged failures are basic. A current risk analysis, signed business associate agreements, and tested breach notification procedures all appear on any serious compliance checklist. The two technical gaps described, the lack of multi-factor authentication and alerts that no one received, are also treated by regulators as ordinary expectations.
• Related companies still need to document how data moves between them. The states alleged that affiliated firms with access to protected health information lacked the required agreements. Sharing an owner or a brand doesn’t automatically eliminate the need to define and document who may use protected health information and how.
• Enforcement has a long tail. The breach occurred in March 2023, and the settlement came more than three years later. A gap that exists today can be examined long after the news cycle has moved on.

What to Do Now

1. Require multi-factor authentication for remote access and for any system that holds health information.
2. Encrypt health information wherever it’s stored.
3. Check that your security alerts reach a real person, and that someone is responsible for acting on them.
4. Confirm you have signed business associate agreements with every vendor and affiliate that handles protected health information.
5. Update your risk analysis and keep it current as systems and vendors change.
6. Rehearse your breach notification process, including state-law requirements, which can be stricter than HIPAA.

The HIPAA E-Tool^® helps covered entities and business associates build these basics into one documented program, so you can show your work to any regulator who asks, federal or state.