◆ Northwell Health in New York and Cook County Health in Chicago each experienced impacts from a breach at Nevada-based transcription company Perry Johnson & Associates (PJ&A) that affected nearly 9 million patient records in multiple states overall. According to PJ&A’s cyber incident notice, an unauthorized party gained access to the company’s network between March 27 and May 2 “and, during that time, acquired copies of certain files from PJ&A systems.”^[1] The transcription company determined that the files involved contained personal health information that potentially included names, dates of birth, addresses, medical record numbers, hospital account numbers, admission diagnoses and dates and times of service. For some individuals, the impacted data may have included Social Security numbers, insurance information and clinical information from medical transcription files, such as laboratory and diagnostic testing results, medications, the name of the treatment facility and the names of health care providers. Cook County Health reported that records of 1.2 million patients were affected by the breach and said it had terminated its relationship with PJ&A upon learning of the data security incident.^[2] Northwell Health reportedly may have had more than 3.8 million affected patients.^[3]

◆ Truepill, a digital health startup that provides pharmacy fulfillment services for health care organizations, confirmed that hackers accessed the personal data of more than 2.3 million patients. In a data breach notice published on its website, the company said that Postmeds, the parent company behind TruePill, experienced a “cybersecurity incident” that allowed unnamed attackers to gain access to files used for pharmacy management and fulfillment services between Aug. 30 and Sept. 1. The company’s investigation found that the accessed files contained sensitive customer information, including patient names, unspecified demographic information, medication type and the name of the patient’s prescribing physician. Truepill said Social Security numbers were not involved. The company’s website said that Truepill has served more than 3 million patients and delivered 20 million prescriptions since it was founded in 2016. In response to the breach, Truepill said it was enhancing its security protocols and rolling out additional cybersecurity training for employees.^[4]