Labcorp Settles Multistate Data Breach Investigation for $2.28 Million

Labcorp agreed to pay $2.28 million to 44 state attorneys general to resolve an investigation into a 2019 data breach at its former debt-collection vendor, American Medical Collection Agency (AMCA). The breach at AMCA's parent company, Retrieval-Masters Creditors Bureau, exposed personal information of more than 27.5 million people nationwide. The settlement resolves state enforcement actions stemming from the vendor's inadequate data security practices. For Medicaid managed care organizations and providers using third-party vendors for billing and collections, this enforcement action underscores state regulators' willingness to hold covered entities accountable for vendor data security failures affecting patient information, including Medicaid beneficiaries.

Managed Care