Labcorp To Pay $2.28 Million In Multistate Settlement Over 2019 AMCA Data Breach

Settlement puts new vendor-management and cybersecurity obligations on Labcorp and medical-debt collectors after a breach at American Medical Collection Agency potentially exposed information tied to 27.5 million people.

Labcorp will pay $2.287 million to 44 states and adopt expanded security controls for vendors and debt collectors under a multistate settlement stemming from the 2019 breach at American Medical Collection Agency (AMCA), a third-party medical-debt collector.

The settlement is significant for the collection industry because it treats protection of patient data as a responsibility that cannot simply be outsourced with the collection account. Although the intrusion occurred at AMCA, which operated as Retrieval-Masters Creditors Bureau, the states concluded that Labcorp retained a duty to oversee the vendor entrusted with its patients’ sensitive information.

Scope of the breach

The AMCA incident potentially exposed personal information associated with more than 27.5 million people nationwide, according to the attorneys general. The group included approximately 10.2 million Labcorp patients. In New York alone, the breach affected roughly 420,000 Labcorp patients, officials said.

AMCA was a medical-debt collector serving laboratories and diagnostic-testing businesses. A hacker accessed AMCA’s internal systems between Aug. 1, 2018, and March 30, 2019, according to the New York Attorney General’s Office. Information potentially exposed included Social Security numbers, payment-card data, names of medical tests and diagnostic codes.

Pennsylvania Attorney General Dave Sunday said as many as 218,408 Pennsylvania residents may have been affected. Pennsylvania will receive $43,313 from Labcorp’s payment to the participating states.

The exact payment under the agreement is $2,287,455. New York is set to receive $89,178, while Connecticut will receive $81,296.

Collection-specific obligations

The settlement goes beyond a monetary penalty and imposes detailed vendor-governance requirements, with heightened provisions directed at medical debt collectors.

Labcorp must:

• Improve its information-security program and maintain an incident-response plan that includes internal reporting of vendor security events.

• Minimize the data provided to vendors, while still allowing debt collectors to receive the information needed to satisfy their legal obligations.

• Expand vendor-risk management through a dedicated oversight team, vendor-evaluation tools and processes to verify compliance.

• Maintain contract inventories for debt collectors.

• Require cybersecurity standards in collector contracts.

• Require segmentation of data that may otherwise be aggregated by a collector across multiple creditor clients.

• Require assessments and audits of debt-collection vendors.

• Preserve a contractual right to terminate vendors that do not comply with the security requirements.

• Retain an independent third-party assessor to evaluate Labcorp’s information-security program, with an emphasis on vendor-risk management.attorneygeneral+1

For agencies and creditors, the requirement to segment client data may be especially consequential. Medical collection agencies often receive and process account files from multiple providers, which can create a larger target and magnify the impact of a single security failure. The settlement explicitly calls out aggregation risks and expects controls tailored to that operating model.

Regulators emphasize non-delegable duty

Connecticut Attorney General William Tong said the resolution rests on the principle that companies handling protected health information remain accountable for vendors that receive that information.

“Labcorp outsourced their debt collection, and they shared sensitive personal information for millions of patients that was ultimately compromised,” Tong said. “Labcorp was responsible for vetting and managing that vendor, and we’re holding them accountable.”

Pennsylvania’s Sunday similarly characterized the agreement as a measure intended to reduce the likelihood that highly sensitive medical data will be accessed again by attackers.

The states’ position is clear: a covered entity may contract with a collection agency, but it cannot contract away responsibility for reasonable information-security oversight. That approach increases pressure on creditors to establish documented due diligence, enforceable security terms, ongoing monitoring and remediation or termination procedures for collection vendors.

Earlier AMCA resolution and class action

The Labcorp settlement supplements an earlier multistate resolution involving AMCA. That agreement included a $21 million suspended payment, but AMCA’s bankruptcy limited the practical recovery, according to the states.

Labcorp also agreed to a separate $35 million settlement in related class-action litigation. The litigation remains ongoing against other AMCA client covered entities, according to the Connecticut and Pennsylvania attorneys general.

Takeaway for creditors and collectors

For creditors, healthcare providers and agencies, the settlement illustrates that vendor oversight has become an operational compliance obligation—not merely a procurement or contract-management function.

Organizations that transmit consumer or patient information to collection vendors should review whether they can demonstrate:

• Data minimization in placement files and subsequent account updates.

• Written cybersecurity standards incorporated into collector agreements.

• Due diligence before onboarding and periodic reassessment afterward.

• Audit, remediation and termination rights that are actually usable.

• Incident-response processes that account for vendor-originated events.

• Segmentation and access controls where collectors store data from multiple clients.

• Clear internal ownership of third-party risk management.

The Labcorp resolution sends a pointed message to the medical collection ecosystem: regulators may hold the original data owner responsible when an agency’s security breakdown exposes consumer data, even if the breach takes place entirely within the collector’s systems.