Labcorp will pay more than $2.28 million to a coalition of 44 attorneys general to resolve a multistate investigation into the 2019 data breach at its former debt-collection vendor, American Medical Collection Agency.
The breach occurred at AMCA and potentially exposed the personal information of more than 27.5 million people nationwide, according to a Sept. 24 press release from Pennsylvania Attorney General Dave Sunday.
Under the settlement, Labcorp will pay $2.29 million to the participating states. The company also agreed to strengthen its vendor risk management program, including hiring a dedicated oversight team, expanding audits and compliance checks of vendors, minimizing data shared with outside companies, and building an incident response plan that covers vendor security events. It must also hire a third-party assessor to review its vendor risk management practices.
“This settlement will provide necessary protections to minimize the chances of such sensitive medical data being accessed again by bad actors,” Mr. Sunday said in the release.
The agreement follows a 2021 multistate settlement with AMCA itself, which included a $21 million payment that was suspended due to the company’s bankruptcy. It is separate from a $35 million class-action settlement Labcorp has reached with affected patients in ongoing litigation.
