- Connecticut AG William Tong led a coalition of 44 AGs in obtaining a $2.3 million multistate settlement with Laboratory Corporation of America (LabCorp), resolving an investigation into the 2019 data breach at LabCorp’s debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency (AMCA), that potentially exposed the personal information of over 27.5 million individuals, including 10.2 million LabCorp patients. We previously reported on the AGs’ initial investigation in 2019.
- The settlement includes numerous requirements around vendor management, especially medical debt collection, including developing certain aspects of the company’s information security program, minimizing the sharing of data with vendors while balancing certain needs of debt collectors to meet their legal obligations, expanding the vendor risk management program, adding specific requirements for debt collectors as a specialized subset of vendors, and hiring a third-party assessor to perform an information security assessment.
- The settlement requires LabCorp to make a payment of $2,287,244 to the states. The settlement supplements a 2021 multistate settlement with AMCA itself, after the company’s bankruptcy petition was dismissed, which included a $21 million suspended payment. LabCorp has also agreed to a $35 million settlement in the related class action lawsuit, which is still ongoing with other AMCA client covered entities.