Federal authorities are investigating a 2023 data breach at a medical transcription company that may have compromised the personal information of up to 1.2 million patients at Chicago-based Cook County Health, NPR affiliate WBEZ reported June 10.
According to documents obtained by the radio station, in November, a grand jury subpoena was sent to Cook County Health asking the system for "any and all information related to the data security incident" that hit Perry Johnson & Associates in 2023.
The subpoena revealed that acting U.S. Attorney Morris Pasqual and a prosecutor from the Justice Department's fraud section requested Cook County officials provide PJ&A's contract with the county, records of Cook County's background checks on PJ&A and all communications between the health system and the company about the data breach.
Federal authorities also asked the system's department of risk management to provide a "list of affected individuals and the compromised data" along with any documents "related to identifying the unauthorized third party that accessed PJ&A data."
Cook County Health spokesperson Alexandra Normington told the publication the subpoena was the "initial contact" it had with federal investigators regarding the breach. She said the health system has "fully cooperated" with authorities, though it is not aware of the details of the federal investigation.
The breach at Perry Johnson & Associates has affected several hospitals and health systems, including Cincinnati-based Bon Secours Mercy Health and New Hyde Park, N.Y.-based Northwell Health.
PJ&A officials and an attorney representing them did not respond to WBEZ's request for comment.