纽约州牵头四州与医疗转录公司达成和解：1330万人病历泄露，涉事公司须付至多1000万美元
美国纽约州、康涅狄格州、密歇根州与新泽西州四州总检察长11月6日共同宣布，与 Perry Johnson 系列公司就2023年3月一起大规模数据泄露达成和解。涉事公司为医疗机构提供编码、账单与转录服务，泄露记录涉及逾1330万人，包括姓名、出生日期、住址、社会安全号、医院账户号、诊断、保险信息以及化验与影像检查结果、用药名称等医疗转录内容。
按纽约州总检察长办公室公布的和解条款，涉事五家公司合计须支付至多1000万美元，其中30万美元为确定支付的罚款与费用，须在协议生效后14天内缴清，纽约州至少分得10万美元，康涅狄格州分得66,666美元；其余约970万美元暂缓执行，若公司违反协议、或总检察长认定其关于自身财务状况的陈述有重大不实，暂缓部分即须支付。
和解涵盖 Perry Johnson & Associates、Perry Johnson Inc. 及其编码与放射业务单位、Medical Transcription and Coding Inc. 共五家公司。和解文件显示，其中四家公司已资不抵债并停止经营。
四州总检察长办公室均未点名入侵者或黑客组织，各方公告也未说明被盗记录在泄露后的三年多里是否被用于身份盗窃或诈骗。纽约州总检察长办公室近年多次就医疗数据安全达成和解，今年10月从一家儿科医疗网络与IT公司取得270万美元，9月与 Labcorp 达成230万美元和解，7月与 23andMe 达成1800万美元和解。（来源：纽约州总检察长办公室）
New York Leads Four-State Settlement With Perry Johnson Companies Over Breach Exposing 13.3 Million Patients' Records
The attorneys general of New York, Connecticut, Michigan and New Jersey announced on November 6 a settlement with the Perry Johnson companies over a March 2023 data breach that exposed records tied to more than 13.3 million people. The companies provided coding, billing and medical transcription services to health care organizations, and the exposed records included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information and clinical details such as laboratory and diagnostic test results and medication names.
Under the agreement announced by the New York attorney general's office, the five companies will pay up to $10 million. A guaranteed $300,000 in penalties and costs is due within 14 days of the agreement taking effect, with New York receiving at least $100,000 and Connecticut receiving $66,666. The remaining $9.7 million is suspended and becomes due only if the companies violate the agreement or if the New York attorney general finds their statements about their finances were materially inaccurate. The settlement is paid to the states; there is no claims process for affected patients.
The settlement covers five companies: Perry Johnson & Associates, Perry Johnson Inc., its coding and radiology units, and Medical Transcription and Coding Inc. According to the settlement agreement, four of the five companies are insolvent and inactive.
No hacker or group has been named in the attorneys general's releases, and the releases do not say whether the stolen records were misused for identity theft or fraud. The New York attorney general's office has reached a series of health data settlements this year, securing $2.7 million from a pediatric health network and IT company in October, $2.3 million and reforms from Labcorp in September, and $18 million from 23andMe in July. (Source: New York State Attorney General)
来源：纽约州总检察长办公室
发布：GSM·美国（发布链接）
图片来源：图片来源：Wikimedia Commons「Albany.jpg」（Karthikc123 摄，Public domain） Image: Wikimedia Commons "Albany.jpg" (by Karthikc123, Public domain)
GSM Global · 本篇英文版 English edition of this story
