West Virginia Attorney General · September 24, 2026 · Primary source
Full Story
Read the full document at West Virginia Attorney General.
What this may mean
The settlement establishes that HIPAA-covered entities bear a non-delegable duty to protect patient data entrusted to vendors, and imposes concrete vendor risk management program requirements on Labcorp specific to medical debt collectors, including contract inventories, cybersecurity standards, segmentation, audits, and termination rights for non-compliance. Clinical laboratories and other covered entities that share patient data with third-party debt collectors face a concrete enforcement template for what 44 state AGs consider minimum vendor oversight. The settlement supplements a prior $21 million suspended AMCA settlement and a separate $35 million Labcorp class action settlement.
Informational only. Not legal, medical, financial, or other professional advice. Always consult a qualified professional familiar with your specific facts before relying on any item.
Related items
- West Virginia Attorney General · June 24, 2026Full StoryScore 98
- OCR HIPAA Breach Portal · September 16, 2026OCR HIPAA Breach: Beaver County Behavioral Health, PA, 501 affected, Hacking/IT IncidentScore 95
- Massachusetts Attorney General · October 20, 2026AG Campbell Secures $1 Million Recovery From Transformative Healthcare For Allegedly Submitting False Claims To MassHealth And Failing To Safeguard Sensitive Patient InformationScore 94
- OCR HIPAA Breach Portal · October 1, 2026OCR HIPAA Breach: Leggett & Platt, Incorporated Employee Benefit Plan, MO, 61,702 affected, Hacking/IT IncidentScore 89
- Vermont Attorney General · September 29, 2026Attorney General Clark Announces Multistate Settlement with Labcorp Over the American Medical Collection Agency Data BreachScore 89
- Connecticut Attorney General · September 25, 2026Attorney General Tong Leads $2.3 Million Multistate Settlement with LabCorp Over the American Medical Collection Agency Data BreachScore 89