Attorney General JB McCuskey announced that West Virginia, as part of a coalition of 44 attorneys general, has reached a $2.3 million multistate settlement with the Laboratory Corporation of America (“Labcorp”). The settlement resolves the investigation into the 2019 data breach at Labcorp’s debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency (“AMCA”). The breach potentially exposed the personal information of more than 27.5 million people nationwide, including 10.2 million Labcorp patients, impacting more than 145,000 consumers in West Virginia.
Although the breach occurred at AMCA, the data belonged to Labcorp’s patients. Companies may contract with vendors freely, but data security is a non-delegable duty. HIPAA-covered entities must protect personal and health information and oversee the vendors entrusted with it.
“One of the biggest responsibilities companies have—especially companies that have access to our personal identifiable information—is to keep that information secure. Labcorp and the AMCA did not live up to the trust we put in them. By holding them accountable, we are putting all companies on notice: they must keep patients’ and clients’ personal information secure,” Attorney General McCuskey said.
The settlement requires Labcorp to strengthen vendor management, particularly for medical debt collectors, by:
- Enhancing its incident response plan to include internal reporting of vendor security events;
- Minimizing data shared with vendors while accounting for debt collectors’ legal obligations;
- Expanding its vendor risk management program with a dedicated team, evaluation tools, and compliance verification;
- Adding debt collector-specific requirements, including contract inventories, contractually enforced cybersecurity standards, data segmentation, audits, and termination rights for non-compliance; and
- Hiring a third-party assessor to review its information security, with a focus on vendor risk.
Labcorp will pay $2,287,455 to the states, of which $34,023 is payable to West Virginia. The settlement supplements the 2021 multistate settlement with AMCA, which included a $21 million suspended payment due to the company’s bankruptcy. Separately, Labcorp agreed to a $35 million settlement in the related class action lawsuit.
The Attorneys General of Connecticut, Florida, Indiana, Illinois, Michigan, and Texas led the investigation, assisted by the Executive Committee of the Attorneys General of West Virginia, Maryland, Massachusetts, New York, North Carolina, and Tennessee. The Attorneys General of Alaska, Alabama, Arizona, Arkansas, Colorado, the District of Columbia, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, and Wisconsin in the investigation.