Labcorp Reaches $2.3M Settlement with 44 Attorneys General Over Debt Collector Data Breach

HIPAA-regulated entities often need to transmit protected health information (PHI) to third parties to assist with treatment, payment and healthcare operations functions. These vendors, which may include cloud storage services, data analytics companies, information technology service providers and other entities that create, receive, maintain or transmit PHI on behalf of other entities, are required under the HITECH Act to maintain the security of electronic PHI. Recently, 44 attorneys general aligned on this exact issue, drawing attention to the issue of oversight of vendors handling health information and health data.

Effective October 1, 2026, Laboratory Corporation of America Holdings (Labcorp) agreed to pay $2,287,455 and overhaul its vendor oversight to resolve an investigation by attorneys general of 43 states and the District of Columbia. The investigation arose from a data breach experienced by one of Labcorp's debt collection vendors that was announced in 2019. The settlement, styled as an Assurance of Voluntary Compliance and treated as an Assurance of Discontinuance (the Assurance), resolves potential claims under state consumer protection, privacy and breach notification laws, as well as HIPAA. Labcorp did not admit liability or wrongdoing.

Beyond the monetary payment, the Assurance imposes injunctive relief that includes:

• a requirement that Labcorp not misrepresent the extent to which it maintains and protects the privacy, security or confidentiality of consumer information
• an annual review and update of Labcorp's information security program, with the first review due within 120 days of the effective date; the program must include:
  • employing an appropriately qualified chief information security officer (CISO) to oversee the implementation and maintenance of the information security program and advise the CEO and board of directors regarding Labcorp's security and risks
  • security and privacy awareness training for all personnel who handle consumer data
• specific safeguards such as an incident response plan; a process for timely reporting of vendor security events to senior management and/or the board; policies and procedures governing the collection, use, disclosure and retention of PHI and other consumer data; limiting disclosures of PHI to vendors to the minimum necessary; and policies specific to sharing PHI and consumer data with debt collectors
• a vendor risk management program, including written policies and procedures that are reviewed at least annually, a vendor risk management team, security assessment and monitoring tools aimed at vendors, and vendor questionnaires. The vendor risk management program must also contain additional measures aimed specifically at debt collectors, including an inventory of debt collector contracts, the data they handle and a risk rating. Labcorp is additionally required, through a business associate agreement or other written contract or amendment of existing agreements, to require debt collectors to implement industry-recognized cybersecurity standards and frameworks, such as the National Institute of Standards and Technology's (NIST) Cybersecurity Framework. The contracts must require the debt collectors to comply with specific data security requirements, including:
  • when feasible, segmenting Labcorp's PHI and consumer data from that of other companies if the arrangement involves a multitenant environment or using alternative reasonable measures
  • restricting personal information and PHI to the minimum necessary, where applicable
  • disposing of data under NIST standards
  • storing cryptographic keys only in accordance with secure key management requirements
  • using passwords to protect cryptographic keys that are as strong as the keys they protect
  • maintaining a process to remediate critical vulnerabilities reported by the United States Computer Emergency Readiness Team or an equivalent governmental agency
  • conducting annual risk assessments covering consumer personal information and PHI
  • engaging in penetration testing, at least annually, for portions of their networks that are used to store, process or transmit PHI or consumer personal information
  • conducting annual SOC 2 Type 2 Audits or biannual HITRUST CSF Validated Assessments

Labcorp's debt collection contracts must also outline the role of the debt collection vendor and Labcorp in the event of a vendor security event, including the provision of consumer notices. The contracts must also allow Labcorp to take appropriate action against any debt collection vendor that is not complying with the applicable requirements in the Assurance.

Within 18 months, Labcorp must obtain an assessment of its compliance with the Assurance from an independent third-party Certified Information Systems Security Professional or equivalent. Many of the Assurance's obligations expire five years after the effective date.

Lessons Learned

Although the breach occurred at a vendor, the settlement signals that state attorneys general expect organizations handling sensitive data to protect that data after it leaves their hands. Maryland Attorney General Anthony Brown stated, "This settlement holds Labcorp accountable for failing in that duty and requires the company to maintain stronger vendor oversight to prevent this kind of breach from happening again." Connecticut Attorney General William Tong asserted that "Labcorp was responsible for vetting and managing that vendor, and we're holding them accountable." Nevada Attorney General Aaron Ford emphasized that companies holding sensitive medical and personal information "cannot outsource" their responsibility to protect it.

The bottom line: Vendor oversight is now an enforcement priority, and the obligations imposed on Labcorp offer a practical road map for any organization looking to strengthen data protections when it relies on vendors.

For more information or questions, please contact the author.