More than 450,000 Maryland residents were among those potentially affected by a massive data breach involving Labcorp patient information, according to Maryland Attorney General Anthony G. Brown.
Maryland has joined a bipartisan coalition of 44 attorneys general in reaching a $2.3 million multistate settlement with Laboratory Corporation of America, better known as Labcorp, following an investigation into the 2019 breach.
The breach occurred at Labcorp’s debt collector, Retrieval-Masters Creditors Bureau, which operated as American Medical Collection Agency (AMCA). It potentially exposed personal information belonging to more than 27.5 million people nationwide, including approximately 10.2 million Labcorp patients.
According to the Maryland Attorney General’s Office, 451,558 Maryland residents were among those potentially affected. Although the breach occurred at AMCA, the sensitive information involved had been collected by Labcorp and belonged to its patients. The settlement centers in part on companies’ responsibilities to protect sensitive information when sharing it with outside vendors.
“Marylanders trust healthcare companies to protect their most sensitive medical information, even when that information is shared with outside vendors,” Brown said. “This settlement holds Labcorp accountable for failing in that duty and requires the company to maintain stronger vendor oversight to prevent this kind of breach from happening again.”
Under the settlement, Labcorp will be required to strengthen its information security program and vendor oversight practices. Requirements include expanding its incident response plan to address vendor security incidents, minimizing the amount of information shared with vendors and maintaining a dedicated vendor risk management team.
Labcorp will also be required to impose additional cybersecurity requirements on debt collectors handling its information and hire an independent third-party assessor to evaluate its information security practices with a focus on vendor risk management.
The settlement follows a separate 2021 multistate settlement with AMCA that included a $21 million payment that was suspended because of the company’s bankruptcy.
Maryland was part of the executive committee involved in the Labcorp investigation, which was led by the attorneys general of Connecticut, Florida, Indiana, Illinois, Michigan and Texas.
