Labcorp to overhaul data security practices, pay $2.3 million fine for cybersecurity failings

A bipartisan coalition of 44 state attorneys general on Thursday announced that they settled a lawsuit against Labcorp in exchange for a $2.3 million fine and a promise of sweeping data security reforms in the wake of a 2019 data breach that impacted 10.2 million customers.

The data breach originated with security failings at American Medical Collection Agency (AMCA), a debt collector that Labcorp worked with.  The attorneys general contended that Labcorp should have don’t more to police AMCA, after the incident there impacted a total of 27.5 million people nationwide. 

Security changes include creating an incident response plan for vendor security failings, limiting how much data Labcorp shares with vendors and building an expansive risk management team charged with tracking vendors’ compliance with data security practices. 

Labcorp must also include cybersecurity requirements in vendor contracts and mandate that data collectors routinely provide the medical testing giant with audits documenting their compliance with the new rules.

It must also retain an independent expert to conduct information security assessments and begin siloing data that debt collectors often aggregate for several clients at once.

In 2021, a court sided with the coalition of attorneys general suing AMCA and ordered the debt collector pay a $21 million fine that was suspended because the company went bankrupt.

“Millions of patients’ private health information was potentially exposed because of Labcorp’s failures to protect its customers,” New York Attorney General Letitia James said in a statement Thursday. “As a result of our investigation, Labcorp will make critical changes to protect patients and prevent this kind of data breach from happening again.”

A Labcorp spokesperson did not immediately respond to a request for comment and the company did not issue a press release about the settlement.