Gothamist
A non-profit newsroom, powered by WNYC.
Gothamist
Listen Live
News
4M NYers' data and medical records were exposed in a breach. Here's how to protect against ID theft.
By
Caroline Lewis
Published Nov 28, 2023
Modified Nov 29, 2023
Share
FacebookTwitterRedditEmail
Never miss a story
Email address
By submitting your information, you're agreeing to receive communications from New York Public Radio in accordance with our Terms .
Oscar Wong / Getty Images
By
Caroline Lewis
Published Nov 28, 2023
Modified Nov 29, 2023
Share
FacebookTwitterRedditEmail
We rely on your support to make local news available to all
Make your contribution now and help Gothamist thrive in 2026. Donate today
Gothamist is funded by sponsors and member donations
At least 4 million New Yorkers’ private information could be at risk of identity theft after a data breach at a medical transcription company that works with hospitals in New York, state Attorney General Letitia James said Tuesday.
The company, Nevada-based Perry Johnson & Associates, works with Northwell Health, which has hospitals and clinics across the five boroughs and Long Island, as well as Crouse Health in Syracuse. About 9 million patients nationwide are affected by the breach, according to the attorney general's office.
Most people whose data was affected have been notified of the breach, James said.
The lapse in security potentially revealed private patient information — including Social Security numbers and insurance and clinical information included in medical transcripts — per the consumer alert.
Perry Johnson & Associates became aware of the breach in May, James' office said. But the company said in its own advisory about the incident that it didn't begin sending out notices to patients whose information might have been compromised until Oct. 31.
Gothamist has reached out to ask the company why it took so long to begin sending out notifications. A spokesperson for James' office said the company notified state officials of the breach this month.
Perry Johnson & Associates said an “unauthorized party” accessed its network between March 27 and May 2 and obtained copies of files in the system.
“We value individuals’ privacy and deeply regret any concern that this incident might cause,” the company said in its advisory. “To help prevent something like this from happening again, PJ&A continues to review its safeguards and has implemented additional technical security measures to further protect and monitor its systems.”
It said the exposed data included patients' birthdates, medical record numbers, hospital account numbers, diagnoses and dates of service.
In some cases, the data also included Social Security numbers, insurance information and information from medical transcription files, such as laboratory and diagnostic testing results, medications and healthcare providers' names, the company said.
The information didn't include credit card information, bank account information or usernames and passwords, according to the advisory.
What to do if your data was compromised
Attorney General James advised anyone who might be affected by the breach to:
- Monitor their credit cards and credit reports with a credit monitoring service.
- Review any medical bills and contest any unrecognized charges.
- Notify their insurance company about any suspected fraud.
- In the event of Medicare fraud, notify the U.S. Department of Health and Human Services Office of Inspector General online or at 800-447-8477.
- Obtain a copy of their medical records.
- Consider putting a freeze on their credit reports with Equifax, Experian and TransUnion to prevent anyone from opening credit cards in their name.
Health care data breaches have been on the rise across the U.S. in recent years, according to the HHS. In some cases, these incidents have disrupted hospital operations, in addition to putting patient information at risk.
Earlier this month, New York Gov. Kathy Hochul announced a set of proposed rules for hospitals to beef up their cybersecurity. She included $500 million in the last state budget for hospital technology upgrades, including new cybersecurity tools.
This story has been updated to include a further statement from Attorney General Letitia James' office.
Tagged
privacy
Health and Science
new york attorney general
new york city
public safety
health care
letitia james
information security
Kathy Hochul
cybersecurity
data
Caroline Lewis
Caroline Lewis is on the health care beat for WNYC and Gothamist. She has covered COVID, a nurses' strike, the overdose crisis and New York’s marijuana legalization effort, and spent a year investigating patients' medical bills. She always wants to hear about how everyday New Yorkers experience the health system. Got a tip? Email [email protected].
Read more
Gothamist is funded by sponsors and member donations
Gothamist is funded by sponsors and member donations
MORE news
Man shot and killed on Midtown subway platform Saturday afternoon, NYPD says
Police said they're searching for a person of interest.
By
Ryan Kost
and
Elizabeth Kim
Published Oct 17, 2026 at 1:16 p.m. ET
Modified Oct 17, 2026 at 4:10 p.m. ET
Have you seen this Yorkie? NYPD looking for adorable pup dognapped from her Queens home
Suspects were driving a Subaru Forester, police said.
By
Ryan Kost
News
Have you seen this Yorkie? NYPD looking for adorable pup dognapped from her Queens home
Suspects were driving a Subaru Forester, police said.
By
Ryan Kost
Being reigning champions is weird for Knicks fans, but we could get used to this.
By
Catalina Gonella
Tompkins Square Park is getting a makeover. Some say it's too much.
By
Willow Higgins
Deer are all over New Jersey roads looking for sex, state officials warn
By
Rosemary Misdary
Never miss a story
Catch up on the most important headlines with a roundup of essential NYC stories, delivered to your inbox daily.
Sign upEmail address
By submitting your information, you're agreeing to receive communications from New York Public Radio in accordance with our Terms .