Perry Johnson Data Breach: What to Check in Your Medical and Credit Records

A medical bill can be worrying enough when you recognize the appointment. It’s more unsettling when you’ve never heard of the clinic named on it.

That doesn’t mean the first caller who knows your medical history can explain it. Start with records you can check for yourself.

Overview

A vendor may have your records even if you never hired it

Perry Johnson & Associates, also known as PJ&A, provided services including medical coding, billing, and transcription to health care organizations.

You could recognize the hospital where you received care without knowing which company helped process information connected with that visit.

The New York Attorney General’s announcement says the March 2023 breach affected more than 13.3 million people. The settlement was announced on November 6, 2026.

That’s a settlement about the earlier breach, not a second breach that began when the announcement appeared. The dates answer different questions.

Medical details and identity details create different risks

Authorities say the exposed files included data such as names, Social Security numbers, insurance information, diagnoses, and details contained in medical transcription records.

That list describes the files as a whole. It doesn’t say every patient’s file contained every category, or that every affected person has experienced fraud.

An exposed Social Security number is relevant to new-account fraud. An exposed insurance number may be more relevant when reviewing claims for care you didn’t receive.

Clinical information can also make an impersonation call sound convincing. A caller who names a real test or medication still hasn’t proved who they are.

Three things worth checking separately

• Your exposure: Ask the provider that treated you whether you were affected and which information it can identify in your case.
• Your claims and records: Look for unfamiliar services, providers, prescriptions, or other entries, then ask the insurer or provider to check them.
• Your financial identity: If sensitive identifiers were exposed, review credit reports and consider credit freezes as a separate protective step.
• Any new request: Verify a caller, letter, or email independently before sharing information or paying a bill.

The breach and any later misuse are different events. A suspicious charge deserves attention, but it isn’t proof that it came from these records.

Start with the real insurer or provider, rather than trying to identify the origin of every detail mentioned in a call.

What the Settlement Establishes

The timeline begins in 2023

According to the state investigation, attackers accessed PJ&A systems using an employee’s credentials in March 2023. Remote access did not require multifactor authentication at the time.

The attorney general says activity was recorded but the system didn’t notify the people who needed to respond. The company learned of the intrusion from the attackers.

Those findings concern a business system, not the security of a patient’s home computer. Changing your portal password can’t retract a record exposed at a vendor.

Still, check your own sign-in if you receive a genuine notice about an account change, or if you entered credentials on a site you don’t trust.

The headline amount is not a payment to patients

The agreement calls for at least $300,000 in penalties and costs to the states, with $9.7 million more if the companies fail to comply.

It also calls for safeguards such as multifactor authentication, encryption, risk assessments, and policies for how long sensitive records are kept.

Don’t treat the headline number as a personal award. The attorney general’s announcement doesn’t establish a check waiting for every person whose records were affected.

If someone cites the settlement to ask for a fee or your financial details, stop. Use an independently located government or provider channel to verify their claim.

How to check your connection to a vendor

Begin with the hospital or practice named on a notice you received. Use the contact information from a prior statement, the patient portal, or its official website.

Ask for the privacy office and give it the approximate dates of care. Ask whether the PJ&A incident affected records that relate to you.

If you switched providers, a new clinic may not know how an earlier one handled its records. Start with the organization that provided the care in question.

If the notice is old, ask whether the provider has updated instructions or a new contact for questions. A number printed years ago may no longer help.

What to Do if Your Information May Have Been Exposed

1. Verify the notice with your provider. Contact its privacy office using a known number. Ask whether you’re affected and what categories of data it can confirm.
2. Review insurance claims. Open the insurer’s official portal or call the number on your card. Flag unfamiliar providers, services, or prescriptions for review.
3. Check the underlying medical record if a claim is wrong. Contact the provider directly and ask for its process to request records and dispute errors.
4. Protect against new credit fraud if identifiers were exposed. Review your credit reports and consider placing a freeze separately with all three U.S. credit bureaus.
5. Secure accounts if you gave away a password. Start with the affected portal and its recovery email, then replace reused passwords and enable available extra verification.
6. Report confirmed identity misuse. Use the FTC’s recovery site for a plan and keep correspondence, statements, and case numbers together.
7. Don’t pay an unsolicited settlement contact. Verify it separately. Never give an incoming caller a portal code or complete identity documents to prove a claim.

Start with the insurer when a claim appears first

An Explanation of Benefits describes how an insurer handled a claim. It isn’t necessarily a bill or a demand for payment.

Check the service date, location, and type of care. A hospital visit can generate separate claims from a lab, specialist, or other organization you don’t recognize.

If a name looks unfamiliar, ask the insurer which visit the claim is connected to. Don’t start by calling a number supplied in a suspicious message.

When the service itself wasn’t yours, ask the insurer to open a case and tell you whether it needs a written dispute or supporting records.

Save the reference and request confirmation of any correction. Check future statements to make sure the same service doesn’t appear again under a different bill.

Check the chart when the information could affect care

Insurance and medical records aren’t interchangeable. A disputed charge can be removed while a diagnosis, allergy, or procedure remains in the clinical record.

Use the provider’s records department to ask for the relevant entries. Explain clearly that the care or medication listed wasn’t yours.

The FTC’s medical identity theft guide recommends challenging incorrect records in writing and keeping evidence of receipt.

If the record affects a decision about your care now, tell your clinician while the correction is pending. Don’t wait for the billing office to notify them.

Ask what was corrected, which organization made the change, and whether related providers need to check their copies. Keep the response where you can find it.

Separate a Real Bill From a Convincing Call

Use the account you already know

Imagine someone calls about a real hospital visit and says you must pay a small balance before your insurance claim can be reopened.

You can decline to discuss the account on that call without ignoring a possible bill. Call the hospital or insurer yourself using a number you trust.

Ask it to identify the date, service, and amount from its own records. Compare that with your statement before deciding whether any payment is due.

Don’t read out a one-time sign-in code, even if the caller knows your address. That code could authorize access to the actual patient portal.

Use credit protection for the problem it solves

If your Social Security number was exposed, review all three U.S. credit reports. Look for accounts, addresses, or inquiries you can’t explain.

A freeze helps prevent many new credit accounts from being opened. It doesn’t block a claim against your health insurance or fix a record at a hospital.

You can ask about both risks in the same afternoon, but you’ll be contacting different organizations and keeping different confirmation numbers.

Get a recovery plan at IdentityTheft.gov if you find misuse. Don’t upload reports or insurance statements to a public comment thread.

Keep checking even when a notice isn’t recent

Changing providers or insurance plans doesn’t erase old records. An earlier plan can still answer questions about claims for the time you were covered.

Keep the old insurer’s name and your coverage dates in your notes. You’ll have a better starting point if a bill surfaces months later.

Set a reminder to check the next available statement if there was a specific disputed claim. You don’t need to reopen every prior visit at once.

If a family member received a notice, help them locate the official contact. Let the provider tell you what permission it needs before discussing their records.

What to Save if You Need to Dispute Something

Keep a short timeline of notices, claims, and calls. Include the date you found a problem and the case number the organization gave you.

Save a copy of the relevant statement or record entry. Don’t circulate the entire chart if you only need to show one incorrect service.

Record which organization made each correction. A clinic may fix the chart while the insurer still needs to adjust the claim on its own side.

If a debt collector contacts you, ask for documentation through a verified channel. An unresolved dispute shouldn’t be settled by paying the first person who calls.

Check whether a corrected bill, claim, or report actually reflects the change. A verbal assurance and a corrected record are two different things.

If you’re not sure what to do first, address any active fraud or incorrect medical information. Then work through preventive measures that don’t depend on a dispute.

What to ask when a provider can’t name the exposed fields

Sometimes a privacy office can confirm that a notice was sent but can’t say whether your particular record contained a Social Security number or insurance ID.

Ask for the categories it can confirm and the categories that remain unknown. Record the difference rather than treating the absence of detail as reassurance.

If a letter mentions credit monitoring, check the provider’s current guidance through its official site. Don’t enroll through a code shared by a stranger in a message.

Don’t post a photo of the whole notice to ask whether it’s real. A mailing label, enrollment code, or reference number might reveal more than you intend.

Ask the privacy office whether there was a separate notice from another organization involved in your care. Avoid opening multiple disputes for the same charge.

When a family member is helping you

Have the patient initiate the call when possible. Let the insurer or provider explain how to authorize a trusted relative to assist with the conversation.

Use one notebook for dates, reference numbers, and questions. Keep the actual records elsewhere so they aren’t carried to appointments or left in the car.

If the affected person is a child, ask the provider whether any identification numbers were involved. A child’s financial identity and medical records need separate attention.

If you manage care for an older relative, watch for calls that reference an actual procedure and claim to need payment right away. Verify every new request.

Don’t hand a caller a Medicare number just to check whether they already have it. Contact the plan or Medicare directly if a suspicious claim appears.

Settle on one verified contact per organization. Then anyone helping can call back safely without sorting through old texts for a number that might be wrong.

Frequently Asked Questions

Did the Perry Johnson data breach happen in 2026?

No. The state investigation describes access beginning in March 2023. November 2026 is when the attorneys general announced the settlement.

How could PJ&A have information about me?

Health care organizations used PJ&A for services such as coding, billing, and transcription. You wouldn’t necessarily have dealt with the vendor yourself.

Was every person’s Social Security number exposed?

The announcement lists Social Security numbers among the exposed data types. It doesn’t specify that every affected record contained one. Ask your provider about your notice.

Is an unfamiliar insurance claim always identity theft?

No. It can also reflect a billing error or a provider name you didn’t recognize. Ask the insurer to match it to the actual service.

Does a credit freeze protect my medical records?

No. A freeze addresses new credit access. To investigate an incorrect medical claim or chart entry, contact the insurer and provider responsible for those records.

Do I need to pay to see if I’m included in the settlement?

Don’t pay an unsolicited contact to check eligibility. Verify any claim about a payment independently. The enforcement announcement isn’t a notice of a personal award.

The Bottom Line

If your provider says you were affected, review insurance claims and address any incorrect medical records. Consider credit protection if identity information was exposed.

Don’t rely on a caller who knows a diagnosis or cites the settlement. Hang up and call the insurer or provider through a number you already trust.