HARRISBURG, PA — Labcorp will pay more than $2.28 million and strengthen oversight of vendors handling patient information under a settlement with Pennsylvania and 43 other states stemming from a 2019 data breach that potentially exposed information belonging to more than 27.5 million people, including as many as 218,408 Pennsylvanians.
The breach occurred at Retrieval-Masters Creditors Bureau, a Labcorp debt collector doing business as American Medical Collection Agency, or AMCA. The compromised information involved Labcorp patients, according to the Pennsylvania Attorney General’s Office.
Pennsylvania will receive $43,313 of Labcorp’s $2,287,455 payment to participating states.
The settlement imposes new requirements governing how Labcorp manages vendors entrusted with personal and protected health information, with particular requirements for medical debt collectors.
Labcorp must further develop its information security program, including an incident response plan addressing internal reporting of vendor security events. The company also must limit information shared with vendors while accounting for debt collectors’ legal obligations.
Vendor risk management requirements include a dedicated team, tools for evaluating vendors and procedures for verifying compliance.
Medical debt collectors will face additional controls, including contract inventories, contractual cybersecurity standards, data segmentation and required assessments and audits. Labcorp also must retain the ability to terminate relationships for noncompliance.
The settlement further requires an independent third-party assessment of Labcorp’s information security program, with an emphasis on vendor risk management.
“Vendor management remains one of the most challenging areas in cybersecurity, but it is critical that businesses properly vet their vendors and ensure that information shared with those vendors will be kept secure,” the Attorney General’s Office stated.
Attorney General Dave Sunday characterized the requirements as safeguards intended to reduce the risk of sensitive medical information being accessed in another breach.
The agreement supplements an earlier multistate settlement with AMCA that included a $21 million payment suspended because of the debt collector’s bankruptcy.
Separately, Labcorp has agreed to a $35 million settlement in a related class-action lawsuit that remains ongoing against other AMCA client entities.
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.