Laboratory Assistant 2

Alaska asks court to approve its share of $2.3 million Labcorp data breach settlement. Alaska has asked an Anchorage judge to approve its part of a $2.3 million multistate settlement with Labcorp over a 2019 data breach at the medical testing company's debt collector, which potentially exposed information on 10.2 million Labcorp patients nationwide. Acting Attorney General Cori Mills's office filed the petition Thursday in Anchorage Superior Court, the same day a coalition of 44 attorneys general, including Alaska's, announced the settlement. State law requires court approval for this kind of agreement, in which a company promises to change its practices. The agreement is not an admission of wrongdoing, and the attorney general can reopen the matter later. The breach happened at American Medical Collection Agency, the business name of Retrieval-Masters Creditors Bureau, which Labcorp used to collect medical debts. Someone had unauthorized access to the collector's system from Aug. 1, 2018, through March 30, 2019. The breach potentially exposed information on more than 27.5 million people across all of the collector's clients, including 10.2 million Labcorp patients. Labcorp has said its own systems were not affected and that no test orders, results or diagnostic information from the company were in the collector's system. "Labcorp was responsible for vetting and managing that vendor," said Connecticut Attorney General William Tong, whose office led the investigation. Labcorp will pay $2,287,455 to the states. Shares published by other states include $81,296 for Connecticut, $43,313 for Pennsylvania and $17,534 for Wisconsin. The money goes to the states, not to consumers. States that need court approval, as Alaska does, receive payment after it is granted. The settlement also requires Labcorp to appoint a chief information security officer and to have an independent firm assess how it manages the security risks of its vendors within 18 months of the Oct. 1 effective date. Its vendor-management requirements last until Oct. 1, 2031. The agreement adds to a 2021 multistate settlement with the debt collector itself, which included a $21 million payment that was suspended because of the collector's bankruptcy. Labcorp has separately agreed to pay $35 million to settle a related class-action lawsuit, which is still ongoing against other companies the collector served. What did you make of this story? (no account needed) Drafted with AI. Edited by Cale Green (1 revision). Reviewed by Cale Green. Who is accountable.

LabCorp pays states $2.2M in settlement over AMCA hack. 42 States, DC Require Lab to Strengthen Security, Vendor Risk Management Practices Marianne Kolbasuk McGee (HealthInfoSec) - September 25, 2026 LabCorp has agreed to pay $2.2 million and improve its data security and vendor risk management practices - especially with debt collectors - to resolve multistate litigation stemming from a 2019 hack on American Medical Collections Agency. The hack affected more than 10.2 million patients of the medical testing lab, and the settlement announced on Thursday resolves a list of claims against North Carolina-based LabCorp involving a variety of state consumer protection and personal information protection laws, as well violations of federal laws, including HIPAA. Under the HITECH Act of 2009, state attorneys general were granted the right to pursue federal HIPAA violations. Retrieval-Masters Creditors Bureau, a then-42-year-old New York business operating under the name American Medical Collection Agency, or AMCA, filed for bankruptcy just weeks after discovering the breach in 2019 and ultimately went out of business. Besides LabCorp, the AMCA hack affected dozens of the firm's other clients and about 27.5 million people nationwide. "Companies entrusted with consumers' sensitive health and personal information remain responsible for protecting that information when they share it with outside vendors," said Jennifer Davenport, attorney general of New Jersey, where 417,308 LabCorp patients were affected by the AMCA hack. "Businesses cannot outsource their obligation to safeguard consumer data. This settlement reinforces the importance of carefully vetting vendors and maintaining strong oversight to ensure the information entrusted to them remains secure," Davenport said. Under the settlement, LabCorp will pay New Jersey $68,000. The financial settlement also will be divided in varying amounts among the other states. Besides the financial payments, LabCorp has agreed to overhaul its data security and vendor risk management practices. That includes employing a CISO - an executive or officer "with appropriate credentials, background and expertise in information security who shall be responsible for overseeing the implementation and maintenance" of the bolstered information security program, according to the settlement. LabCorp also is required to minimize the amount of data shared with vendors; expand its vendor risk management program, including establishing a dedicated team, using tools to evaluate vendors; and verify that vendors comply with security requirements. The plan also calls for LabCorp to impose additional requirements on debt-collection vendors including maintaining inventories of contracts; putting cybersecurity requirements into contracts; segmenting LabCorp data from information debt collectors hold for other clients; requiring collectors to conduct security assessments and audits; and giving LabCorp the contractual right to terminate vendors for noncompliance. "Covered entity responsibility for the actions of their business associates is a longstanding area of concern," said regulatory attorney David Holtzman, retired founder of consulting firm HITprivacy. When the HIPAA Security Rule was first enacted in 2005, it allowed covered organizations - such as medical testing labs, hospitals and clinics - "to take a hands-off approach to how their vendors and contractors handled protected health information," Holtzman said. The HITECH Act extended direct HIPAA compliance liability to business associates, but that "only goes so far," Holtzman said, who was also previously an adviser in the U.S. Department of Health and Human Services' Office for Civil Rights, which oversees federal HIPAA enforcement. "HHS can solve this problem through regulatory action to extend reasonable vendor management standards to covered entities and business associates that engage subcontractors," Holtzman added. The settlement with the state attorneys general also comes on the heels of LabCorp agreeing in June to pay $35 million to settle proposed civil class action litigation related to the AMCA incident. Under that agreement, LabCorp also said it would improve its data security practices (see: LabCorp Agrees to Pay $35M to Settle AMCA Data Breach). A coalition of 41 state attorneys general in 2021 also reached a $21 million settlement with AMCA in the incident (see: Debt Collection Firm Reaches Breach Settlement With States). AMCA first learned that the company might have a problem when it received a series of "Common Point of Purchase" notices in 2019 suggesting that a disproportionate number of credit cards that at some time had shown up on AMCA's web portal were later associated with fraudulent charges, court documents said. AMCA said it shut down its web portal to prevent any further compromises of customer data and engaged outside consultants who confirmed that AMCA's servers had been hacked as early as August 2018. LabCorp did not immediately respond to ISMG's request for comment on the settlement with the state attorneys general. The 42 states participating in the settlement are Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, Wisconsin and West Virginia - involved in the settlement - plus Washington D.C.