RELEASE: OFFICE OF CONSUMER PROTECTION ANNOUNCES MULTISTATE DATA BREACH SETTLEMENT

STATE OF HAWAIʻI

KA MOKU ʻĀINA O HAWAIʻI

JOSH GREEN, M.D.

GOVERNOR

KE KIAʻĀINA

DEPARTMENT OF COMMERCE AND CONSUMER AFFAIRS

KA ʻOIHANA PILI KĀLEPA

NADINE Y. ANDO

DIRECTOR

KA LUNA HOʻOKELE

OFFICE OF CONSUMER PROTECTION

MANA MORIARTY

EXECUTIVE DIRECTOR

OFFICE OF CONSUMER PROTECTION ANNOUNCES MULTISTATE DATA BREACH SETTLEMENT

FOR IMMEDIATE RELEASE

September 29, 2026

HONOLULU - The Hawaiʻi Department of Commerce and Consumer Affairs Office of Consumer Protection ("OCP"), as part of a coalition of 44 attorneys general, has settled with the Laboratory Corporation of America ("Labcorp") resolving the multistate investigation into the 2019 data breach at Labcorp's debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency ("AMCA").

The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients of which 17,347 are Hawaiʻi residents. The multistate coalition settled with AMCA in 2021 after the company's bankruptcy petition was dismissed.

"People in Hawaiʻi should feel confident their personal and health information is protected. This settlement makes clear that HIPAA-covered organizations can't pass the buck to their vendor when it comes to HIPAA compliance," said Mana Moriarty, executive director of the Office of Consumer Protection. "Stronger vendor-management rules mean better protection for patients and help prevent the kind of large-scale data exposure we saw in the AMCA breach."

Although the breach occurred at AMCA, the compromised data belonged to Labcorp's patients. Companies may contract with vendors and delegate tasks, but data security remains a non-delegable duty - and HIPAA-covered entities must oversee the vendors entrusted with personal and health information. The settlement establishes strong vendor management requirements, particularly for medical debt collection, including:

• Developing certain aspects of the company's information security program, such as an incident response plan that includes internal reporting of vendor security events;
• Minimizing the sharing of data with vendors while balancing certain needs of debt collectors to meet their legal obligations;
• Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance;
• Adding specific requirements for debt collectors as a specialized subset of vendors, including maintaining contract inventories, enforcing cybersecurity standards through contract, segmenting data which is often aggregated by debt collectors for multiple clients, and requiring debt collectors to perform assessments and audits, and including the right of termination for non-compliance; and
• Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management.

As part of the settlement, Labcorp will make a payment of $2,287,455.00 to the states, of which $17,628 is payable to Hawaiʻi. This settlement will supplement a multistate settlement with AMCA itself which included a $21,000,000 suspended payment due to its bankruptcy. Separately Labcorp has agreed to a $35,000,000 settlement in the related class action lawsuit, which is still ongoing with other AMCA client covered entities.

The Attorneys General of Connecticut, Florida, Indiana, Illinois, Michigan and Texas led the investigation. They were assisted by the Executive Committee of the Attorneys General of Maryland, Massachusetts, New York, North Carolina and Tennessee, who were joined by the Attorneys General of Alaska, Alabama, Arizona, Arkansas, Colorado, the District of Columbia, Delaware, Georgia, Idaho, Iowa, Kansas, Kentucky, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, Wisconsin and West Virginia, as well as the Office of Consumer Protection in Hawaiʻi.

# # #