Labcorp agreed to pay $2.3 million and overhaul its security practices after state attorneys general said its handling of a vendor contributed to a 2019 breach affecting 10.2 million customers. The incident stemmed from security failures at debt collector American Medical Collection Agency, which handled Labcorp data and was part of a wider breach affecting 27.5 million people nationwide. The settlement requires incident response planning for vendor failures, tighter limits on shared data, contract-level cybersecurity requirements, compliance audits, independent security assessments, and better separation of client data held by collectors.
Why it matters: This matters because it shows healthcare organizations can face penalties not just for their own breaches but for weak oversight of third-party data handlers. Healthcare providers and other firms using outside vendors should review contracts, data-sharing scope, and vendor audit requirements now.
2026.09.25
100% relevant
This article establishes a distinct tracked story around the multistate settlement and mandated security reforms stemming from Labcorp's role in the 2019 AMCA-related breach.
← Back to all stories