LABCORP TO PAY $2.3 MILLION AND OVERHAUL VENDOR SECURITY AFTER 2019 AMCA DATA BREACH

Labcorp has agreed to pay $2,287,455 to a coalition of 44 attorneys general and implement broad cybersecurity and vendor-risk reforms stemming from a 2019 breach at one of its former debt-collection vendors that potentially exposed information belonging to 10.2 million Labcorp patients.

The agreement resolves a multistate investigation into Laboratory Corporation of America Holdings and its relationship with Retrieval-Masters Creditors Bureau, which did business as American Medical Collection Agency, or AMCA. The settlement is structured as an Assurance of Voluntary Compliance and takes effect October 1, 2026. It does not constitute an admission of wrongdoing or a finding of liability against Labcorp.

The underlying breach occurred at AMCA, a New York-based medical debt collector that handled accounts for Labcorp and other healthcare companies. According to the New York Attorney General’s Office, an unauthorized person accessed AMCA systems between August 1, 2018, and March 30, 2019. The incident potentially exposed information belonging to more than 27.5 million people nationwide across AMCA’s affected clients, including approximately 10.2 million Labcorp patients. About 420,000 affected Labcorp patients lived in New York.

The compromised information potentially included Social Security numbers, payment card information, names of medical tests, diagnostic codes, and other personal information maintained by AMCA. State investigators said AMCA failed to detect the intrusion despite receiving warnings from payment-processing banks concerning suspicious activity.

The Labcorp settlement shifts much of the focus from the original intrusion itself to the cybersecurity obligations companies carry when sensitive information is placed in the hands of outside vendors.

Under the agreement, Labcorp must maintain an information security program covering personal information and protected health information handled by the company and its vendors. The program must be reviewed and updated annually, and Labcorp must maintain an executive or officer with information-security expertise responsible for overseeing the program and advising senior leadership and the company’s board on security risks.

Personnel with access to consumer personal information or protected health information must receive security-awareness and privacy training. New employees covered by the requirement must receive training within 30 days of hire, while existing personnel must receive training at least annually.

Labcorp must also maintain an incident-response plan specifically addressing security incidents involving vendors. Vendor security events must be reported internally to senior management, the board of directors, or an appropriate board committee based on the type of vendor and the amount and sensitivity of information involved.

The agreement places new limits on how much protected health information Labcorp can provide to outside vendors. Disclosures must be restricted to the minimum information necessary for the intended purpose under applicable HIPAA requirements.

Debt collectors receive additional scrutiny.

Labcorp must maintain procedures governing information shared with debt collectors and establish a process requiring those companies, at least annually, to confirm in writing that personal information or protected health information has been deleted, destroyed, or made unreadable after a debt is satisfied or a collection referral is withdrawn, subject to applicable legal retention requirements.

The company must also operate a formal Vendor Risk Management Program designed to document whether vendors are maintaining reasonable security measures. A dedicated vendor-risk team must oversee that program and report to Labcorp’s chief information security officer at least quarterly concerning identified vendor risks and mitigation plans.

Vendor assessments may include questionnaires, attestations, independent audits, formal security certifications, and on-site inspections. The level of scrutiny must be tied to the risk presented by each vendor, including the nature of the services performed and the amount and type of consumer information involved.

Debt collectors must be tracked through a contract inventory identifying what categories of personal information or protected health information each collector possesses, processes, transmits, stores, or accesses. The inventory must also include risk ratings and records of questionnaires, assessments, penetration tests, and outside security audits associated with those relationships.

Labcorp must contractually require debt collectors to use recognized cybersecurity or data-security standards and frameworks. The agreement specifically identifies the National Institute of Standards and Technology Cybersecurity Framework as one example of an accepted framework.

The settlement also addresses a major risk associated with multi-tenant systems used by debt collectors. Labcorp information stored by a debt collector must be segmented from information belonging to other clients where feasible. When technical segmentation cannot reasonably be implemented, alternative safeguards must be used to protect the information.

Debt collectors handling Labcorp data must conduct annual penetration testing covering the portions of their networks used to store, process, or transmit Labcorp consumer information. They must provide annual confirmation that the testing occurred and that critical or high-risk deficiencies identified during those tests have been addressed or are being remediated.

External security audits are also required. Debt collectors must conduct annual SOC 2 Type 2 audits, biannual HITRUST CSF validated assessments, or a reasonably equivalent independent assessment. Labcorp must receive annual confirmation that the audits occurred and that serious deficiencies are being corrected.

Labcorp must retain contractual authority to take action against debt collectors that fail to comply with the required security standards, including terminating the business relationship. Existing debt-collection contracts must be amended within 12 months of the agreement’s effective date to incorporate the applicable requirements.

The settlement adds an outside layer of oversight.

Within 18 months of the effective date, Labcorp must obtain an assessment from an independent third-party information-security professional to assess the company’s compliance with the agreement. The assessor must hold a Certified Information Systems Security Professional credential or an equivalent certification and have at least five years of experience evaluating information-system security and vendor-risk-management practices. A formal assessment report must then be provided to the Connecticut Attorney General’s Office within 60 days of completion. The Connecticut Attorney General’s Office may provide the report to other participating attorneys general upon request.

The financial portion of the settlement requires Labcorp to pay $2,287,455 to the participating states. New York will receive $89,178. Payment is generally due within 30 days of the October 1 effective date, subject to any state-specific approval requirements.

New York Attorney General Letitia James said the case centered on the responsibility companies carry when they maintain sensitive medical information.

“Millions of patients’ private health information was potentially exposed because of Labcorp’s failures to protect its customers,” James said. She said the settlement requires changes intended to strengthen protections for patients and reduce the risk of another breach involving third-party vendors.

The agreement resolves civil claims the participating attorneys general could have brought under HIPAA, state consumer-protection laws, personal-information protection laws, breach-notification statutes, and related common-law theories tied to Labcorp’s conduct involving the AMCA incident before the settlement’s effective date. The agreement preserves enforcement authority for future conduct and does not waive private rights of action.

Several of the core vendor-security requirements remain enforceable for five years after the settlement takes effect. Those obligations include internal vendor-incident reporting, data-sharing controls, debt-collector safeguards, vendor-risk management, penetration testing, external audits, and contractual enforcement provisions.

The Labcorp agreement follows a separate multistate settlement reached with AMCA in 2021. That agreement included a $21 million payment that was suspended because AMCA had filed for bankruptcy.

The 2026 Labcorp settlement places the emphasis on a broader cybersecurity problem that extends beyond a company’s own network perimeter. Organizations handling health information, financial data, and other sensitive records can build strong internal defenses and still face exposure when third parties are allowed to store, process, or access the same information without equivalent controls.

The settlement addresses that weakness by moving vendor security from a contractual formality into an auditable operating requirement. Labcorp must know which vendors hold sensitive data, understand the risk attached to those relationships, restrict the amount of information being shared, require independent security testing, track remediation, and retain the authority to terminate vendors that fail to meet required standards.

For healthcare organizations operating through large networks of laboratories, billing services, contractors, technology providers, and debt collectors, the AMCA breach demonstrates how a compromise several steps removed from the primary company can still expose millions of patients.

The resulting settlement now requires Labcorp to treat that third-party exposure as part of its own cybersecurity perimeter.

New York State Office of the Attorney General / Labcorp Multistate Assurance of Voluntary Compliance, Assurance No. 26-053. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE