Cook County Health notifies 1.2 million patients of breach at vendor PJ&A

Cook County Health, the Illinois public health system that operates John H. Stroger Jr. Hospital and Provident Hospital in Chicago, said in early November 2023 that data on about 1.2 million patients may have been exposed in a breach at a former vendor.

The vendor was Perry Johnson and Associates, a firm that provided medical transcription services to the health system. PJ&A notified Cook County Health on July 21, 2023 that it was investigating a cyberattack and confirmed the breach days later. Its forensic investigation found that an unauthorized individual accessed and copied Cook County Health patient data held on PJ&A systems in April 2023. The final list of affected patients was not delivered to the county until October 9.

The exposed records could include names, dates of birth, addresses, medical record numbers, encounter numbers, medical information and the dates and times of service. Cook County Health said Social Security numbers may also have been involved for roughly 2,600 patients.

Cook County Health said it stopped sending data to PJ&A as soon as it learned of the incident and terminated the business associate agreement. It began mailing notices to affected patients and offered free credit monitoring and identity protection to those whose Social Security numbers were involved. The system said it had no evidence that any information had been misused.