Attorney Generals Secures $2.3 Million and Reforms to Protect Consumers After Labcorp Data Breach

 

Massive Data Breach Exposed the Personal Information of Over 27.5 Million People Nationwide

New York Attorney General Letitia James today joined a bipartisan coalition of 43 other attorneys general in securing approximately $2.3 million and critical reforms to protect consumers from Laboratory Corporation of America (Labcorp) after a 2019 data breach impacted millions of Labcorp customers. The data breach affected Labcorp’s debt collector, American Medical Collection Agency (AMCA), potentially exposing the personal information of over 27.5 million people nationwide, including 10.2 million Labcorp patients, 420,000 of which lived in New York. As part of a settlement with Attorney General James and the coalition, Labcorp will overhaul its data security practices and develop a new system for sharing data with third party debt collectors to protect consumers. Labcorp will also pay approximately $2.3 million to the states, including nearly $90,000 to New York.

“Corporations have a responsibility to protect their customers’ private data, especially sensitive medical information,” said Attorney General James. “Millions of patients’ private health information was potentially exposed because of Labcorp’s failures to protect its customers. As a result of our investigation, Labcorp will make critical changes to protect patients and prevent this kind of data breach from happening again.”

AMCA is based in Elmsford, New York and specializes in small-balance medical debt collection, primarily for laboratories and medical testing facilities. Labcorp, based in Burlington, North Carolina, provides laboratory testing for diagnostic services. Between August 1, 2018 and March 30, 2019, a hacker accessed AMCA’s internal system and was able to collect customers’ personal information. Despite numerous warnings from banks that processed their payments about a potential breach, AMCA failed to detect the intrusion. The breach exposed the personal information – including Social Security numbers, payment card information, and names of medical tests and diagnostic codes – of approximately 420,00 New Yorkers.

As a result of Attorney General James and the coalition’s investigation, Labcorp must make comprehensive changes to its security policies to better protect its customers, especially when they interact with Labcorp’s vendors. These changes include:

• Improving Labcorp’s information security program and developing an incident response plan that includes internal reporting of vendor security breaches;
• Minimizing data sharing with vendors while balancing certain needs of debt collectors to meet their legal obligations;
• Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance;
• Implementing new requirements for debt collectors, enforcing cybersecurity standards through contracts, segmenting data which is often aggregated by debt collectors for multiple clients, requiring debt collectors to perform assessments and audits, and including the right of termination for non-compliance; and
• Hiring a third-party assessor to perform an information security assessment with a focus on vendor risk management.

As part of the settlement, Labcorp will pay $2,287,455 to the states, including $89,178 to New York. This settlement will supplement a multistate settlement with AMCA that Attorney General James and the coalition secured in 2021, which included a $21 million suspended payment due to the company’s bankruptcy.

Attorney General James joined in securing this settlement with the attorneys general of Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, Wisconsin, West Virginia, and the District of Columbia.