Patients whose hospitals and doctors used medical-transcription vendor Perry Johnson & Associates (PJ&A) may be covered by proposed class actions alleging PJ&A failed to protect their data in a 2023 breach. No class has been certified for the claims against PJ&A, and there is nothing to file yet; a November 2026 state attorney general settlement pays the states, not patients.
Allegations Only · No Settlement Yet
This article describes consolidated class action complaints. The statements below are unproven allegations. Perry Johnson & Associates and the other defendants have not been found liable, no class has been certified for the claims against PJ&A, and there is nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Perry Johnson & Associates, Inc. (PJ&A) — a medical-transcription vendor based in Henderson, Nevada — is the defendant in consolidated federal litigation over a 2023 data breach. The cases are gathered as In re: Perry Johnson & Associates Medical Transcription Data Security Breach Litigation, MDL No. 3096, before Judge Rachel P. Kovner in the U.S. District Court for the Eastern District of New York. Northwell Health and several of its officers are also named as defendants.PJ&A transcribed dictated notes and reports for many hospitals and physician groups. (It is a distinct company from the similarly named "Perry Johnson" registrar and certification businesses — don't confuse them.) Plaintiffs allege PJ&A failed to protect the patient information it held and was slow to notify the people affected. The defendants have not been found liable, and the allegations remain unproven.
How the Breach Happened
An unauthorized party got into PJ&A's network in the spring of 2023 through a remote-access application, using an employee's login credentials. The New York Attorney General's settlement agreement states that PJ&A's monitoring software recorded the intruders' activity at least as early as March 29, 2023, but had not been set up to alert security staff. PJ&A has said it discovered the activity on May 2, 2023, when the attackers contacted the companies and demanded payment, and later determined which individuals were affected. Notification letters began going out on October 31, 2023 — a gap of about six months that plaintiffs put at the center of their complaints.The exposed data varied by individual and by hospital client, but generally included names, dates of birth, addresses, medical record numbers, hospital account numbers, dates of service, and treatment or diagnosis information. For some individuals it also included Social Security numbers, insurance or subscriber information, and clinical details drawn from transcription files. Because the information sits at the intersection of identity and health data, plaintiffs allege the exposure carries a heightened, long-term risk.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
How Many People, and Which Hospitals
The single company-confirmed figure is the one PJ&A itself reported to the U.S. Department of Health and Human Services: 8,952,212 individuals, or about 8.95 million. Because several of PJ&A's hospital clients filed their own separate breach reports on top of PJ&A's, cybersecurity trade-press tallies put the total across all client notifications at roughly 13 to 14 million people. Read the higher number as an aggregate across many reports, not as a single confirmed count.Named affected clients include Northwell Health (about 3.89 million people, the largest single client), Cook County Health (about 1.2 million), Crouse Health, Salem Regional, Bon Secours Mercy Health, and Concentra, among others. Many patients never had a direct relationship with PJ&A and so received a notice under their hospital or provider's name — which is why so many people did not recognize the vendor at the center of the breach.
What the Lawsuits Allege
The consolidated complaints allege that PJ&A (and, for its patients, Northwell) failed to implement reasonable, industry-standard data-security measures to protect the sensitive patient information it held, and that it failed to notify affected individuals promptly. The plaintiffs bring the negligence, breach-of-implied-contract, invasion-of-privacy, and related claims typical of healthcare data-breach litigation, and seek to represent the affected patients.As with any complaint, these are allegations only. The defendants have not been found liable, no class has been certified, and they dispute the claims. Because a data-breach class is a fixed list of people who received notices, any settlement that eventually emerges would very likely require a claimant to enter a notice ID or similar identifier — but that is a question for a future settlement, not something that exists today.
The November 2026 State Attorney General Settlement
On November 6, 2026, the attorneys general of New York, Connecticut, Michigan and New Jersey announced an up-to-$10 million settlement with PJ&A, Perry Johnson, Inc. and three related companies. It is a state enforcement agreement, not a settlement of this class action. The companies owe $300,000 in penalties and costs to the states; the other $9.7 million is suspended and becomes due only if the states find the companies' financial representations were not materially accurate or the companies violate the agreement. The agreements describe PJ&A and three of the affiliates as insolvent and inactive.The agreements set up no fund for patients and no claim form, and they state that nothing in them limits any person's private rights. The companies neither admitted nor denied the attorneys general's findings, which include that PJ&A did not require multi-factor authentication for remote access when attackers logged in with an employee's credentials in March 2023, and that the stolen files held records on more than 13.3 million people. The full breakdown is in OCA's report on the Perry Johnson state settlement.
Is There a PJ&A Settlement Yet?
Not one that patients can claim from. The state attorney general settlement above pays the states, and the class action has not produced a settlement with PJ&A.A September 3, 2026 report and recommendation in the MDL states that the defendants' motions to dismiss were still pending before Judge Kovner. The same filing addresses a proposed $2.5 million class settlement with North Kansas City Hospital and Meritas Health Corporation that covers only their patients; the magistrate judge recommended preliminary approval and recommended deferring notice to class members while further settlements are possible. As of that filing, no notice or claim form had gone out, and that proposal does not resolve the claims against PJ&A or the other hospitals. For PJ&A patients generally there is no settlement fund, no claim form, no payout and no deadline to act. If the cases are resolved through a settlement, or a class is certified, a formal claims process with its own eligibility rules and deadlines would be announced separately, and OpenClassActions.com would cover it. Be skeptical of any site presenting a "PJ&A settlement claim form" today — no court-approved settlement exists.
Who Is Affected
The affected population is patients whose healthcare providers used PJ&A for transcription and whose records were in PJ&A's systems during the spring-2023 intrusion. In practice, that means people who received a breach-notification letter beginning in late October 2023 (and into 2024 as more clients notified), often under the name of a hospital such as Northwell or Cook County Health.The notification letters identify which categories of a person's data were involved, and settlement claim processes in data breach cases commonly ask for the notice ID or the information in those letters. Under federal law, credit freezes at the three nationwide credit bureaus are free, and the Federal Trade Commission publishes guidance on medical identity theft, which can show up as unfamiliar providers or services on an insurance Explanation of Benefits. As of November 8, 2026, there is nothing to file in connection with the PJ&A breach.
For breach settlements that are open and claimable now, see OCA's data breach settlements tracker.
Frequently Asked Questions
Is there a PJ&A data breach settlement yet?
Not one that patients can claim from. On November 6, 2026, the attorneys general of New York, Connecticut, Michigan and New Jersey announced an up-to-$10 million settlement with Perry Johnson & Associates and four related companies, but it is a state enforcement agreement, not a class action settlement: $300,000 is payable to the states, $9.7 million is suspended, and there is no consumer fund or claim form. The class action, MDL No. 3096 in the Eastern District of New York, is separate. As of a September 3, 2026 court filing, motions to dismiss were pending and the only proposed class settlement described in that filing was a $2.5 million deal covering North Kansas City Hospital and Meritas Health patients, with notice deferred. No defendant has been found liable, and there is no claim form or deadline for PJ&A patients.
What happened in the PJ&A breach?
PJ&A is a medical-transcription vendor that converted doctors' dictation into records for many hospitals and provider groups. An unauthorized party accessed PJ&A's network in the spring of 2023 using an employee's credentials; the New York Attorney General found that PJ&A's monitoring software recorded the activity at least as early as March 29, 2023, and PJ&A has said it discovered the incident on May 2, 2023. Because patients did not have a direct relationship with PJ&A, many learned of the breach through their hospital or provider's name when notification letters went out beginning October 31, 2023.
How many people were affected?
PJ&A's own report to the U.S. Department of Health and Human Services listed 8,952,212 individuals, about 8.95 million. Several PJ&A hospital clients filed their own breach reports on top of that, and the November 2026 settlement agreements with the New York, Connecticut and New Jersey attorneys general state that the breach affected more than 13.3 million people, including about 4.2 million New York residents.
What information was exposed?
The data varied by individual and by hospital client, but generally included names, dates of birth, addresses, medical record numbers, hospital account numbers, dates of service, and treatment or diagnosis information. For some individuals it also included Social Security numbers, insurance or subscriber information, and clinical details from transcription files.
Which hospitals were affected?
PJ&A served many provider clients, several of which filed their own breach reports. Northwell Health was the largest single client (about 3.89 million people), followed by Cook County Health (about 1.2 million), with others including Crouse Health, Salem Regional, Bon Secours Mercy Health, and Concentra. If your provider used PJ&A for transcription, you may have received a notice under your provider's name rather than PJ&A's.
Sources
• Justia Dockets — In re Perry Johnson & Associates Medical Transcription Data Security Breach Litigation, MDL No. 3096: JPML Docket (MDL 3096)• U.S. District Court, E.D.N.Y. — member docket for the consolidated MDL (No. 1:24-md-03096), via GovInfo: E.D.N.Y. Court Record
• U.S. Department of Health & Human Services — Office for Civil Rights breach portal (search "Perry Johnson"): HHS OCR Breach Portal
• New York Attorney General — announcement of the four-state Perry Johnson settlement (Nov. 6, 2026): NY Attorney General Announcement
• New York Attorney General — Assurance of Discontinuance No. 26-039: New York Agreement (PDF)
• U.S. District Court, E.D.N.Y. — Report and Recommendation, ECF No. 214 (Sept. 3, 2026), via CourtListener: MDL 3096 Report and Recommendation (PDF)
• TechCrunch — reporting on the scale of the PJ&A breach (Nov. 15, 2023): TechCrunch Coverage
