Acting Attorney General Cori Mills Announces Settlement with Labcorp over Data Breach That Affected the Personal Data of Alaskans

September 25, 2026

(Anchorage, AK) - Acting Attorney General Cori Mills has announced that Alaska, as part of a coalition of 44 attorneys general, has settled with the Laboratory Corporation of America ("Labcorp") after a multistate investigation into the 2019 data breach that leaked personal patient information through a medical debt collector.

Labcorp used Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency ("AMCA") to handle outstanding customer bills. As part of the process, Labcorp transferred patient information to AMCA. The 2019 AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients of which 82,958 are Alaska residents. The multistate coalition settled with AMCA in 2021 after the company's bankruptcy petition was dismissed.

The data breach occurred at AMCA, but the data involved was the sensitive data of Labcorp's patients. While companies can contract with vendors freely and delegate authority, data security is a non-delegable duty. This means that Labcorp had a duty to guarantee any third-party company it worked with was capable of securing patient data. Vendor management remains one of the most challenging areas in cybersecurity, but it is critical that businesses properly vet their vendors and ensure that information shared with those vendors will be kept secure.

"When a patient's medical debt is sent to collections, the last thing a consumer should have to worry about is whether their sensitive medical data is protected," said AG Mills. "This settlement tells the healthcare industry that it cannot turn a blind eye to how its vendors store and protect patient data."

HIPAA-covered entities have a duty to protect personal and protected health information and oversee vendors entrusted with that information. In addition to a monetary award to the states here, the settlement also provides strong requirements around vendor management, especially medical debt collection including:

• Developing certain aspects of the company's information security program, such as an incident response plan that includes internal reporting of vendor security events;
• Minimizing the sharing of data with vendors while balancing certain needs of debt collectors to meet their legal obligations;
• Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance;
• Adding specific requirements for debt collectors as a specialized subset of vendors, including maintaining contract inventories, enforcing cybersecurity standards through contract, segmenting data which is often aggregated by debt collectors for multiple clients, and requiring debt collectors to perform assessments and audits, and including the right of termination for non-compliance; and
• Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management.

As part of the settlement, Labcorp will make a payment of $ 2,287,455.00 to the states of which $26,010 is payable to Alaska. This settlement will supplement a multistate settlement with AMCA itself which included a $21,000,000 suspended payment due to its bankruptcy. Separately Labcorp has agreed to a $35,000,000 settlement in the related class action lawsuit, which is still ongoing with other AMCA client covered entities.

The Attorneys General of Connecticut, Florida, Indiana, Illinois, Michigan, and Texas led the investigation, assisted by the Executive Committee of the Attorneys General of Maryland, Massachusetts, New York, North Carolina, and Tennessee were joined by the Attorneys General of Alaska, Alabama, Arizona, Arkansas, Colorado, the District of Columbia, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, Wisconsin, and West Virginia.

# # #

Department Media Contact: Information Officer Sam Curtis at [email protected] or (907) 269-6269.

Due to resource constraints, we no longer post links to referenced records. Records filed in a federal court are readily available at Docket Search or PACER, and records filed in a State of Alaska court are readily available from the Alaska Court System (Trial Courts - Alaska Court System and Search for an Appellate Case). Contact Sam Curtis to request a referenced record that is not readily available from a court or on the internet, or contact [email protected] to submit a formal Alaska Public Records Act request.