Labcorp Reaches $2.3M Multistate Settlement Over 2019 Data Breach
Laboratory Corporation of America has agreed to a $2,287,455 multistate settlement with Nevada and 43 other states, alongside a separate $35 million class-action resolution, following a 2019 data breach at its former debt collection vendor, the American Medical Collection Agency. The incident compromised the personal and medical information of more than 27.5 million Americans, including 123,412 consumers in Nevada.
The multistate investigation examined a massive cybersecurity breach originating on the servers of Retrieval-Masters Creditors Bureau, doing business as the American Medical Collection Agency (AMCA). AMCA served as a third-party medical debt collection vendor for Labcorp. While the unauthorized access occurred within the vendor’s digital infrastructure, state regulators scrutinized how healthcare entities handle third-party data handlers.
Nevada Attorney General Aaron Ford announced the settlement on Thursday, detailing the financial terms and compliance mandates imposed on the testing giant. Under the agreement, Labcorp will disburse $2,287,455 across the participating states. Nevada’s share of the payout totals $31,178.
This state-level financial agreement supplements a separate settlement involving AMCA itself, which featured a $21 million suspended payment tied directly to the collection agency’s bankruptcy proceedings.
The breach exposed sensitive records for millions of patients nationwide. Out of the 27.5 million affected individuals across the United States, roughly 10.2 million were Labcorp patients. In Nevada, the compromise touched 123,412 consumers. State data shows that 11,805 of those Nevada residents suffered the exposure of their Social Security numbers.
Labcorp maintains a significant physical footprint across the Silver State, operating 20 patient service centers. Affected communities span multiple municipalities, including Carson City, Sparks, Minden, Elko, North Las Vegas, Henderson, Pahrump, Las Vegas, and Reno.
Attorney General Aaron Ford emphasized the accountability of healthcare providers regarding outsourced data handling. When Nevadans trust companies with sensitive medical and personal information, they expect rigorous protection, Ford noted in a statement, adding that companies cannot outsource that core responsibility and must maintain stringent safeguards.
State investigators highlighted that healthcare entities bound by the Health Insurance Portability and Accountability Act retain an affirmative obligation to oversee third-party vendors handling protected health data, regardless of where the physical servers reside.
To resolve the multistate probe, Labcorp agreed to overhauled vendor oversight protocols specifically targeted at debt collection agencies and third-party partners. The mandated operational changes include minimizing patient data shared with debt collectors to strictly what is legally required and establishing a dedicated vendor risk management team equipped with continuous compliance auditing tools.
Additional compliance requirements dictate that Labcorp must contractually mandate third-party cybersecurity audits, implement strict data segmentation, and enforce immediate contract termination clauses for security failures. The company must also enhance its corporate incident response procedures to track vendor-related security incidents and engage an independent third-party assessor to review its overall information security posture.
The extensive multistate investigation was led by a coalition of state attorneys general from Connecticut, Florida, Indiana, Illinois, Michigan, and Texas. An executive committee comprising officials from New York, Tennessee, Maryland, and North Carolina provided critical assistance throughout the probe.