Attorney General Jeff Jackson Reaches $2.2 Million Settlement with Labcorp Over 2019 Data Breach

The North Carolina Attorney General, joined by 44 other state attorneys general, reached a $2,287,455 multistate settlement with Laboratory Corporation of America (Labcorp) arising from a 2019 data breach at Labcorp's third-party debt collector, the American Medical Collection Agency (AMCA). The breach placed the personal information of more than 27.5 million individuals at risk nationally, including 10.2 million Labcorp patients, of whom 508,111 were North Carolina residents. North Carolina will receive $100,427 of the total settlement amount. A separate settlement with AMCA itself was reached by the multistate coalition in 2021 following dismissal of AMCA's bankruptcy case. The investigation focused on Labcorp's responsibility to ensure that its vendors maintained adequate data security practices for sensitive patient health information, even though the breach originated at AMCA rather than at Labcorp directly. The settlement treats vendor oversight as an obligation of the covered entity that shares patient data, not solely of the vendor that experiences the incident. Under the settlement terms, Labcorp is required to create and implement a comprehensive information security program inclusive of an incident response plan; limit the volume of patient information shared with vendors to what is necessary for vendors to meet their legal obligations; expand its vendor risk management program by establishing a dedicated team to evaluate vendors and verify compliance; and set additional security standards specific to debt collectors, including contract tracking, required cybersecurity protections, client data segregation, security reviews, and contract termination authority for non-compliant vendors. Labcorp must also retain a third-party assessor to conduct an information security assessment with a focus on vendor risk management. Labcorp separately agreed to a $35 million settlement in a related class-action lawsuit involving other AMCA client covered entities; that class action remains ongoing.