44 states settle with Labcorp over 2019 AMCA data breach

According to the Pennsylvania Office of Attorney General, Labcorp has settled with a coalition of 44 attorneys general over a 2019 data breach that exposed patient information through one of its debt collectors.

The breach itself happened at Retrieval-Masters Creditors Bureau, a debt collector doing business as American Medical Collection Agency, or AMCA. Labcorp used AMCA to chase unpaid bills. AMCA's systems were the ones that got breached, but the data was Labcorp's patient data, and more than 27.5 million people nationally had personal information potentially exposed. As many as 218,408 of them were in Pennsylvania.

What the settlement changes

Labcorp will pay more than $2.28 million to the states involved, with $43,313 going to Pennsylvania specifically. The money is smaller than the point being made. The settlement establishes that a company cannot hand patient data to a vendor and treat the vendor's security as the vendor's problem. Attorney General Dave Sunday's office describes data security as a non-delegable duty: Labcorp contracted the debt collection out, but it did not get to contract the responsibility out with it.

The requirements attached to the settlement are specific rather than symbolic. Labcorp has to build an incident response plan that includes internal reporting when a vendor has a security event. It has to reduce how much data gets shared with vendors in the first place, while still letting debt collectors meet their own legal obligations. It has to expand its vendor risk management program, with a dedicated team, tools to evaluate vendors, and ongoing checks that vendors are actually complying, not just promising to. Debt collectors specifically now face added requirements: Labcorp must keep an inventory of its contracts with them, enforce cybersecurity standards through those contracts, segment data rather than letting collectors aggregate it across multiple clients, and require debt collectors to undergo their own assessments and audits. Labcorp also has to retain the right to terminate a vendor that does not comply, and to hire a third-party assessor to check the vendor risk program is working.

Why this matters beyond Labcorp

This settlement follows an earlier one with AMCA itself, which included a $21 million payment that was suspended because AMCA went bankrupt. That earlier settlement could not really be collected. This one can, and it lands on the party that still exists and still holds the patient relationship. The sequence shows something about where accountability actually sticks in a data breach involving outsourced services: it follows the company whose customers were affected, not just the vendor whose systems failed. For anyone whose medical or billing data passes through a debt collector, that is the entity now required to answer for what happens to it.