Attorney General Nessel Announces $2.3 Million Multistate Settlement With Labcorp Over AMCA Data Breach

LANSING – Michigan Attorney General Nessel today announced a $2.3 million multistate settlement (PDF) with the Laboratory Corporation of America (“Labcorp”), resolving an investigation into the 2019 data breach at Labcorp’s debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency (“AMCA”). The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients, of which 78,226 are Michigan residents. The multistate coalition settled with AMCA in 2021 after the company’s bankruptcy petition was dismissed.

While the data breach occurred at AMCA, the data involved was the sensitive data of Labcorp’s patients. Companies can contract with vendors freely and delegate authority; however, data security is a non-delegable duty. Vendor management remains one of the most challenging areas in cybersecurity. It is critical that businesses properly vet their vendors and ensure that information shared with those vendors will be kept secure.

“This breach put the personal information of tens of thousands of Michigan residents at risk,” said Attorney General Nessel. “Companies need to be thoughtful caretakers of their customers’ data, and uphold their security obligations when working with vendors, ensuring strong safeguards are in place. This settlement holds Labcorp accountable to the people of Michigan, and ensures their compliance with strong vendor management measures going forward.”

This settlement upholds the premise that HIPAA-covered entities have a duty to protect personal and protected health information and oversee vendors entrusted with that information. The settlement provides strong requirements around vendor management, especially medical debt collection, including:

• Developing certain aspects of the company’s information security program, such as an incident response plan that includes internal reporting of vendor security events;
• Minimizing the sharing of data with vendors while balancing certain needs of debt collectors to meet their legal obligations;
• Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance;
• Adding specific requirements for debt collectors as a specialized subset of vendors, including maintaining contract inventories, enforcing cybersecurity standards through contracts, segmenting data that is often aggregated by debt collectors for multiple clients, requiring debt collectors to perform assessments and audits, and including the right of termination for non-compliance; and
• Hiring a third-party assessor to perform an information security assessment with a focus on vendor risk management.

As part of the settlement, Labcorp will make a payment of $2,287,455 to the states of which $85,717 is payable to Michigan. This settlement will supplement a multistate settlement with AMCA itself, which included a $21 million suspended payment due to its bankruptcy. Separately, Labcorp has agreed to a $35 million settlement in the related class-action lawsuit. That lawsuit is still ongoing with other AMCA client covered entities.

The attorneys general of Connecticut, Florida, Illinois, Indiana, Michigan, and Texas led the investigation, assisted by the Executive Committee of the attorneys general of Maryland, Massachusetts, New York, North Carolina, and Tennessee and were joined by the attorneys general of Alabama, Alaska, Arizona, Arkansas, Colorado, Delaware, the District of Columbia, Georgia, Hawai‘i, Idaho, Iowa, Kansas, Kentucky, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, West Virginia, and Wisconsin.

###