Perry Johnson & Associates (PJ&A), a medical transcription service provider, has agreed to pay up to $10 million to resolve a multi-state investigation into violations of HIPAA and state law stemming from a breach that exposed the protected health information (PHI) of approximately 9 million individuals. The settlement — one of the largest multi-state healthcare enforcement actions tied to a business associate — underscores a reality I've seen play out across dozens of IR engagements: attackers increasingly target the service providers that sit inside healthcare data pipelines, because that's where PHI from dozens or hundreds of covered entities converges on a single, often under-defended network.
If your organization is a covered entity, this settlement should trigger an immediate review of your business associate agreements and vendor telemetry requirements. If you are a business associate — transcription, billing, collections, IT support, cloud hosting — you are now squarely in regulators' crosshairs, and the security controls OCR and state attorneys general expect are well documented. This post breaks down the PJ&A incident pattern, the detection opportunities defenders had (and you still have), and concrete remediation steps aligned to HIPAA Security Rule expectations.
Technical Analysis
What happened
PJ&A provides medical transcription services to healthcare providers, which means it ingests, processes, and stores large volumes of dictation files, transcribed clinical notes, and associated patient identifiers from multiple client organizations. In the incident underlying this settlement, an unauthorized actor gained access to PJ&A's network and exfiltrated sensitive data including patient names, dates of birth, Social Security numbers, clinical information, and in some cases financial account details — a classic double-value dataset for both identity theft and healthcare fraud.
While no CVE was associated with this intrusion, the attack chain in breaches of this profile (business associates handling bulk PHI) is remarkably consistent across my casework:
- Initial access — typically via exposed remote services (RDP, VPN without MFA), phishing-delivered remote access tooling, or compromised credentials. Transcription workflows often involve internet-facing file transfer portals and legacy SFTP endpoints, which are perennial weak points.
- Persistence and discovery — attackers enumerate file shares and transcription repositories, often living quietly for weeks or months while mapping where PHI concentrates.
- Collection and staging — bulk PHI is aggregated into compressed archives (RAR, 7-Zip, ZIP) on a staging host. This is one of the highest-fidelity detection opportunities available to defenders.
- Exfiltration — data is moved out via Rclone or similar cloud sync tools, SFTP, or plain HTTPS to attacker-controlled infrastructure.
- Extortion or monetization — healthcare data is sold or leaked, triggering breach notification obligations under HIPAA and state law — and, as here, multi-state regulatory action.
Why business associates are the soft underbelly
The regulatory significance of this settlement cannot be overstated. State attorneys general coordinated to hold a vendor accountable, not a hospital. The enforcement theory is straightforward: PJ&A failed to conduct an accurate and thorough risk analysis, failed to implement reasonable access controls and audit controls, and failed to detect and contain the intrusion in a timely manner. Those are the same HIPAA Security Rule deficiencies (45 C.F.R. §§ 164.308(a)(1), 164.312) that appear in virtually every OCR resolution agreement I've reviewed.
Exploitation status: This is not a software vulnerability — it is a demonstrated, actively-repeated intrusion pattern against healthcare data processors. No CISA KEV entry applies; the 'exploit' is the absence of monitoring, segmentation, and MFA. That makes detection engineering, not patching, the primary defensive lever.
Detection & Response
The detection content below targets the highest-fidelity behaviors in this attack chain: mass PHI access, archive staging, and exfiltration tooling. These rules assume a transcription/PHI processing environment where large data stores live on file servers or application hosts — tune the paths and host scoping to your environment before deploying.
Sigma Rules
---
title: Bulk Archive Creation of PHI Directories on Servers
id: 3f8c1a7e-2b4d-4e9f-a1c6-8d5e2f7b9a30
status: experimental
description: Detects compression utilities creating archives from directories associated with transcription output, PHI repositories, or shared medical records storage — a common staging behavior in healthcare data theft such as the PJ&A breach.
references:
- https://attack.mitre.org/techniques/T1560/001/
- https://www.hipaajournal.com/pja-multi-state-settlement-hipaa/
author: Security Arsenal
date: 2026/02/11
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_tools:
Image|endswith:
- '\rar.exe'
- '\7z.exe'
- '\7za.exe'
- '\winzip.exe'
- '\tar.exe'
selection_paths:
CommandLine|contains:
- '\transcription'
- '\transcripts'
- '\dictation'
- '\phi'
- '\medical_records'
- '\patient'
- '\ehr_export'
- '\shares\'
condition: selection_tools and selection_paths
falsepositives:
- Approved backup jobs using compression — scope those service accounts and scheduled tasks as exceptions
level: high
---
title: Rclone or Cloud Sync Tool Execution on Healthcare File Servers
id: 9c2e5b41-7d63-4a08-b3f1-6e8a4c2d1f55
status: experimental
description: Detects execution of Rclone or similar consumer cloud-sync/exfiltration utilities on servers. These tools are routinely used to exfiltrate staged PHI archives to attacker-controlled cloud storage.
references:
- https://attack.mitre.org/techniques/T1567/002/
- https://www.hipaajournal.com/pja-multi-state-settlement-hipaa/
author: Security Arsenal
date: 2026/02/11
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\rclone.exe'
- '\megasync.exe'
- '\gclone.exe'
filter_backup:
CommandLine|contains:
- 'approved-backup-job'
condition: selection and not filter_backup
falsepositives:
- Legitimate cloud backup integrations — maintain an explicit allowlist of sanctioned sync tools and service accounts
level: high
---
title: Excessive File Access on PHI Share by Single Account
id: 6d1f8c29-4a75-4b3c-92de-7f3a5e6b8c12
status: experimental
description: Detects a single user account accessing an abnormally high number of distinct files on PHI-bearing shares within a short window, indicative of bulk collection during a network intrusion.
references:
- https://attack.mitre.org/techniques/T1213/
- https://www.hipaajournal.com/pja-multi-state-settlement-hipaa/
author: Security Arsenal
date: 2026/02/11
tags:
- attack.collection
- attack.t1213
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\transcription\'
- '\medical_records\'
- '\phi\'
- '\patient_data\'
condition: selection
falsepositives:
- Transcriptionists and application service accounts legitimately process high file volumes — baseline per-account and alert on deviation from peer-group norms
level: medium
KQL — Microsoft Sentinel / Defender Hunt
This query hunts the full staging-and-exfiltration chain across endpoints and network telemetry ingested into Sentinel. Run it against servers that host PHI repositories first, then widen scope.
// Hunt: PHI staging via compression followed by outbound transfer tooling
let phi_paths = dynamic(["transcription", "transcripts", "dictation", "medical_records", "patient", "phi", "ehr_export"]);
let archive_tools = dynamic(["rar.exe", "7z.exe", "7za.exe", "winrar.exe", "tar.exe", "makecab.exe"]);
let exfil_tools = dynamic(["rclone.exe", "megasync.exe", "filezilla.exe", "winscp.exe", "psftp.exe", "curl.exe", "gclone.exe"]);
let Staging =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (archive_tools)
| where ProcessCommandLine has_any (phi_paths)
| summarize StagedArchives = make_set(ProcessCommandLine), FirstStaging = min(TimeGenerated), LastStaging = max(TimeGenerated)
by DeviceName, InitiatingProcessAccountName;
let Exfil =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (exfil_tools)
| summarize ExfilCommands = make_set(ProcessCommandLine), FirstExfil = min(TimeGenerated)
by DeviceName, InitiatingProcessAccountName;
Staging
| join kind=inner Exfil on DeviceName
| where FirstExfil >= FirstStaging
| project DeviceName, StagingAccount = InitiatingProcessAccountName, FirstStaging, LastStaging, FirstExfil, StagedArchives, ExfilCommands
| sort by FirstStaging asc;
// Companion: large outbound transfers from PHI-bearing servers (Defender network events)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where DeviceName in ((DeviceProcessEvents | where TimeGenerated > ago(14d) | where ProcessCommandLine has_any (phi_paths) | distinct DeviceName))
| where RemotePort in (443, 22, 21, 990)
| where RemoteIPType == "Public"
| summarize Connections = count(), UniqueDestinations = dcount(RemoteIP), Destinations = make_set(RemoteUrl) by DeviceName, RemoteIP, InitiatingProcessFileName
| where UniqueDestinations < 3 and Connections > 50
| sort by Connections desc;
Velociraptor VQL — Endpoint Hunt
Use this artifact during threat hunts or IR triage on transcription/file servers to surface staging archives and exfiltration tooling in one sweep.
-- Hunt for staged PHI archives and exfiltration tooling on servers
-- Combines running processes, recent archive artifacts, and established outbound connections
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(rclone|7z|7za|rar|winscp|filezilla|megasync)'
OR CommandLine =~ '(?i)(transcription|medical_records|patient|phi|ehr_export)'
LET archives = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Shares/**/*.rar', 'C:/Shares/**/*.7z', 'D:/Data/**/*.zip', 'C:/Users/*/AppData/Local/Temp/**/*.rar'])
WHERE Mtime > now() - 1209600 -- archives created/modified in last 14 days
AND Size > 50000000 -- archives larger than 50MB
LET conns = SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
AND RemotePort in (22, 21, 990, 443)
AND Name =~ '(?i)(rclone|7z|rar|winscp|filezilla|sftp|curl)'
SELECT 'process' AS ArtifactType, Pid, Name, CommandLine AS Detail, Username AS Context, CreateTime AS Observed
FROM procs
UNION ALL
SELECT 'archive' AS ArtifactType, NULL AS Pid, FullPath AS Name, format('%v bytes', args=Size) AS Detail, '' AS Context, Mtime AS Observed
FROM archives
UNION ALL
SELECT 'connection' AS ArtifactType, Pid, Name, format('%v:%v', args=[RemoteAddress, RemotePort]) AS Detail, Status AS Context, NULL AS Observed
FROM conns
Remediation
There is no patch to install here — remediation is architectural and procedural. Prioritize in this order:
For business associates (transcription, billing, IT service providers):
- MFA everywhere, no exceptions. The most common initial access vector in business associate breaches is a remote service without MFA. Enforce phishing-resistant MFA (FIDO2 where possible) on VPN, remote desktop gateways, SFTP portals, and all administrative interfaces.
- Segment PHI repositories. Transcription processing hosts should sit in a dedicated VLAN with no direct internet egress. Force outbound traffic through an inspected proxy; deny direct SFTP/HTTPS from data stores.
- Deploy the detections above and baseline file access. HIPAA's audit control requirement (45 C.F.R. § 164.312(b)) means you must have the logs before you need them. Enable detailed file share auditing on PHI directories and forward to a SIEM with 12+ month retention (6 years is the HIPAA documentation retention floor — align log retention accordingly).
- Encrypt PHI at rest with managed keys, so exfiltrated archives of live shares are your exposure — not entire portable databases. Apply least-privilege so transcriptionist accounts can only reach work-in-progress queues, not the full archive.
- Conduct and document an enterprise-wide risk analysis (45 C.F.R. § 164.308(a)(1)(ii)(A)). Its absence is cited in nearly every OCR settlement. Make it current, scoped to actual ePHI flows, and refresh it annually.
For covered entities (hospitals, clinics, health systems):
- Inventory every business associate touching PHI and verify current BAAs are executed. The PJ&A matter shows regulators will trace liability through the chain.
- Contractually require security telemetry and incident notification SLAs. Your vendors should commit to 24-72 hour breach notification, MFA attestations, and evidence of annual penetration testing.
- Apply data minimization. Send vendors only the data elements they need. Every unnecessary SSN or financial field in a transcription feed is liability you handed away.
- Prepare your notification machinery. Multi-state breaches mean coordinating 50+ state attorney general notifications with varying timelines (some as short as 30 days). Pre-build templates and counsel relationships.
Reference: The full settlement details are covered by The HIPAA Journal at the source URL above. OCR's guidance on the HIPAA Security Rule and its risk analysis requirements is available at hhs.gov/hipaa/for-professionals/security. Healthcare sector threat guidance is maintained by CISA's HPH sector page and the HHS 405(d) HICP practices.
The Bottom Line
A $10 million multi-state settlement against a transcription vendor is regulators telling the entire healthcare ecosystem: the perimeter of your HIPAA obligations extends to every business associate that touches PHI, and 'we didn't know our vendor was compromised' is no longer a defense. The organizations that survive this enforcement climate are the ones that instrument their PHI pipelines — staging detection, egress monitoring, vendor telemetry — before the forensic firm does it for them after the breach.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.