West Virginia Attorney General J.B. McCuskey
CHARLESTON – West Virginia Attorney General J.B. McCuskey’s office has announced a 44-state coalition has reached a $2.3 million settlement with Labcorp over a 2019 data breach.
The settlement resolves the investigation into the 2019 data breach at Labcorp’s debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency. McCuskey’s office says the breach potentially exposed the personal information of more than 27.5 million people nationwide, including 10.2 million Labcorp patients, impacting more than 145,000 consumers in West Virginia.
Although the breach occurred at AMCA, the data belonged to Labcorp’s patients. Companies may contract with vendors freely, but data security is a non-delegable duty. The AG’s office says HIPAA-covered entities must protect personal and health information and oversee the vendors entrusted with it.
“One of the biggest responsibilities companies have – especially companies that have access to our personal identifiable information – is to keep that information secure,” McCuskey said. “Labcorp and the AMCA did not live up to the trust we put in them.
“By holding them accountable, we are putting all companies on notice: they must keep patients’ and clients’ personal information secure.”
The settlement requires Labcorp to strengthen vendor management, particularly for medical debt collectors, by:
Enhancing its incident response plan to include internal reporting of vendor security events;
Minimizing data shared with vendors while accounting for debt collectors’ legal obligations;
Expanding its vendor risk management program with a dedicated team, evaluation tools, and compliance verification;
Adding debt collector-specific requirements, including contract inventories, contractually enforced cybersecurity standards, data segmentation, audits, and termination rights for non-compliance; and
Hiring a third-party assessor to review its information security, with a focus on vendor risk.
Labcorp will pay $2,287,455 to the states, and West Virginia will receive $34,023. The settlement supplements the 2021 multistate settlement with AMCA, which included a $21 million suspended payment due to the company’s bankruptcy. Separately, Labcorp agreed to a $35 million settlement in the related class action lawsuit.
The AGs of Connecticut, Florida, Indiana, Illinois, Michigan and Texas led the investigation, assisted by the Executive Committee of the Attorneys General of West Virginia, Maryland, Massachusetts, New York, North Carolina and Tennessee. The AGs of Alaska, Alabama, Arizona, Arkansas, Colorado, the District of Columbia, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington and Wisconsin joined in the investigation.
