Labcorp fined $2.3M and mandated to overhaul data security after 2019 breach

Settlement Reached for 2019 Data Breach

A bipartisan coalition of 44 state attorneys general announced a settlement with Labcorp. The agreement requires Labcorp to pay a $2.3 million fine and implement significant data security reforms. This action stems from a 2019 data breach that exposed the information of 10.2 million Labcorp customers.

Origin of the Breach

The data breach originated with American Medical Collection Agency (AMCA), a debt collector that worked with Labcorp. The attorneys general argued that Labcorp failed to adequately oversee AMCA's security practices, despite the incident impacting a total of 27.5 million individuals nationwide through AMCA.

In 2021, a court ordered AMCA to pay a $21 million fine, which was suspended due to the company's bankruptcy.

Mandated Security Reforms

Under the settlement, Labcorp must implement several security changes. These include creating an incident response plan specifically for vendor security failings, limiting the amount of data shared with vendors, and establishing a risk management team to monitor vendor compliance with data security practices.

Additionally, Labcorp is required to include cybersecurity requirements in vendor contracts and mandate that data collectors provide routine audits documenting their compliance. The company must also retain an independent expert for information security assessments and begin siloing data that debt collectors often aggregate from multiple clients.

Impact on Patient Data Protection

New York Attorney General Letitia James stated that the settlement aims to prevent future data breaches and protect patient information. The reforms are intended to address Labcorp's past failures in safeguarding customer data, particularly concerning third-party vendor relationships.