Labcorp Faces $2.3 Million Settlement Over 2019 Data Breach
A bipartisan coalition of 44 state attorneys general announced on Thursday that Labcorp has agreed to settle a lawsuit stemming from a 2019 data breach that exposed the personal health information of approximately 10.2 million customers. The settlement includes a $2.3 million financial penalty and a comprehensive set of mandatory data security reforms aimed at preventing future incidents involving third-party vendors.
Breach Traced to Vendor Security Failures at AMCA
The breach originated not within Labcorp’s own systems, but at American Medical Collection Agency (AMCA), a debt collection vendor that Labcorp engaged to manage patient billing. AMCA suffered a cyber intrusion that compromised data belonging to 27.5 million individuals across multiple healthcare providers, including Labcorp’s 10.2 million patients. The attorneys general argued that Labcorp failed to adequately oversee AMCA’s security practices despite the clear risk posed by sharing sensitive patient data with a third party.
Settlement Mandates Sweeping Vendor Risk Management Reforms
As part of the agreement, Labcorp must implement a series of sweeping changes to its vendor risk management program. These include developing a formal incident response plan specifically designed to address security failures by vendors, strictly limiting the volume and type of patient data shared with third-party contractors, and establishing an expanded internal risk management team tasked with monitoring vendor compliance with data security standards.
Labcorp is also required to embed explicit cybersecurity requirements into all future vendor contracts and to mandate that data collectors like AMCA provide regular, independent audits verifying their adherence to the new security protocols. Furthermore, the company must retain an independent third-party expert to conduct periodic information security assessments of its vendor ecosystem.
Data Siloing and Independent Oversight Required
To reduce the aggregate risk posed by vendors serving multiple clients, Labcorp must begin siloing data that debt collectors often combine across several healthcare organizations. This measure aims to limit the potential scale of exposure in the event of a future vendor breach. The settlement also requires Labcorp to maintain ongoing oversight of vendor activities through documented compliance reporting and independent validation.
Context: AMCA’s Prior Legal Settlement and Bankruptcy
The action against Labcorp follows a 2021 court ruling in which the same coalition of attorneys general secured a $21 million fine against AMCA for its role in the breach. However, that financial penalty was ultimately suspended after AMCA filed for bankruptcy, leaving affected patients without direct compensation from the debt collector. The Labcorp settlement shifts accountability to the healthcare provider that entrusted AMCA with sensitive data.
Statement from New York Attorney General Letitia James
"Millions of patients’ private health information was potentially exposed because of Labcorp’s failures to protect its customers," said New York Attorney General Letitia James in a public statement. "As a result of our investigation, Labcorp will make critical changes to protect patients and prevent this kind of data breach from happening again."
Labcorp did not issue a press release regarding the settlement, and a company spokesperson did not respond to requests for comment at the time of the announcement. The agreement reflects a growing trend among state regulators to hold healthcare organizations accountable not only for their own cybersecurity practices but also for the security posture of their third-party vendors.
Source: The Record