Attorney General Ford Announces $2.3 Million Multistate Settlement with Labcorp Over Patient Data Breach

Settlement Requires Stronger Oversight of Vendors Handling Sensitive Patient Information

Carson City, NV - Today, Attorney General Aaron D. Ford announced that Nevada, as part of a coalition of 44 attorneys general, has reached a $2.3 million multistate settlement with Laboratory Corporation of America ("Labcorp"), resolving a multistate investigation into the 2019 data breach at Labcorp's debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency ("AMCA").

As part of the settlement, Labcorp will make a payment of $2,287,455 to the states, of which Nevada will receive $31,178. This settlement supplements the multistate settlement with AMCA, which included a $21 million suspended payment due to the company's bankruptcy. Separately, Labcorp has agreed to a $35 million settlement in the related class action lawsuit, which remains ongoing with other AMCA client covered entities.

"When Nevadans trust companies with their sensitive medical and personal information, they expect it to be protected," said Attorney General Ford. "Companies cannot outsource that responsibility. This settlement holds Labcorp accountable and requires stronger safeguards to protect patient data."

The AMCA breach potentially exposed the personal information of more than 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients. In Nevada, 123,412 consumers had some personal information compromised, including 11,805 consumers whose Social Security numbers were compromised. The multistate coalition previously settled with AMCA in 2021 after the company's bankruptcy petition was dismissed.
While the data breach occurred at AMCA, the information involved was the sensitive data of Labcorp patients. Companies can contract with vendors and delegate authority, but data security is a non-delegable duty. Vendor management remains one of the most challenging areas in cybersecurity, but it is critical that businesses properly vet their vendors and ensure information shared with those vendors is kept secure.

Labcorp currently has 20 locations across Nevada, including locations in Carson City, Sparks, Minden, Elko, North Las Vegas, Henderson, Pahrump, Las Vegas and Reno.

Today's settlement reinforces the principle that HIPAA-covered entities have a duty to protect personal and protected health information and oversee vendors entrusted with that information. The settlement includes strong requirements around vendor management, particularly for medical debt collection, including:

• Developing certain aspects of the company's information security program, such as an incident response plan that includes internal reporting of vendor security events;
• Minimizing the sharing of data with vendors while balancing certain needs of debt collectors to meet their legal obligations;
• Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors and verifying vendor compliance;
• Adding specific requirements for debt collectors as a specialized subset of vendors, including maintaining contract inventories, enforcing cybersecurity standards through contracts, segmenting data that is often aggregated by debt collectors for multiple clients, requiring debt collectors to perform assessments and audits, and including the right of termination for noncompliance; and
• Hiring a third-party assessor to perform an information security assessment with a focus on vendor risk management.

The attorneys general of Connecticut, Florida, Indiana, Illinois, Michigan and Texas led the investigation, assisted by an executive committee consisting of the attorneys general of Maryland, Massachusetts, New York, North Carolina and Tennessee.

Attorney General Ford joined the coalition alongside the attorneys general of Alaska, Alabama, Arizona, Arkansas, Colorado, the District of Columbia, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Minnesota, Missouri, Nebraska, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, Wisconsin and West Virginia.

###