RALEIGH — North Carolina will receive $100,427 under a multistate settlement requiring Labcorp to strengthen safeguards for patient information shared with outside vendors, Attorney General Jeff Jackson announced Sept. 24.
The company will pay $2,287,455 to participating states to resolve an investigation into a 2019 data breach involving its debt collector, American Medical Collection Agency.
The North Carolina Department of Justice said the breach put information belonging to 508,111 North Carolina Labcorp patients at risk. Nationally, it potentially exposed information belonging to more than 27.5 million people, including 10.2 million Labcorp patients. NC DOJ announcement
The breach occurred at the collection agency, also known as AMCA, rather than at Labcorp itself. State officials said Labcorp remained responsible for overseeing the protection of patient information entrusted to its vendors.
Labcorp, based in Burlington, provides laboratory testing services. According to the New York attorney general’s office, a hacker accessed AMCA’s internal system between Aug. 1, 2018, and March 30, 2019.
The settlement requires changes to Labcorp’s information-security program, including an incident response plan and internal reporting of vendor breaches. It also requires the company to limit information shared with vendors while accounting for debt collectors’ legal obligations. New York announcement
Additional requirements focus on monitoring outside companies that handle sensitive information. Labcorp must expand its vendor-risk program, maintain a dedicated team to evaluate vendors and verify compliance with security requirements.
Debt collectors face specific contractual safeguards, including cybersecurity standards, separation of different clients’ data, security assessments and provisions allowing contracts to be terminated for noncompliance. A third-party assessor must evaluate Labcorp’s information security, with particular attention to vendor oversight. Pennsylvania announcement
The agreement follows a separate multistate settlement with AMCA in 2021. Labcorp also agreed to a separate $35 million settlement in related class-action litigation, according to the attorneys general.
The payment announced for North Carolina goes to the state. It should not be confused with an individual patient’s eligibility for compensation through the separate class-action proceeding. NC DOJ announcement
Editor’s note:
This article was drafted with the assistance of artificial intelligence and was reviewed and fact-checked by a member of the NC Political News editorial team before publication.