Labcorp Reaches $2.3M Settlement with 44 Attorneys General Over Debt Collector Data Breach - Holland & Knight
Laboratory Corporation of America Holdings (Labcorp) has agreed to pay $2,287,455 and overhaul its vendor oversight practices to resolve an investigation by 44 attorneys general regarding a 2019 data breach at one of its debt collection vendors.
Effective October 1, 2026, Laboratory Corporation of America Holdings (Labcorp) reached a settlement with attorneys general from 43 states and the District of Columbia over a data breach that occurred at one of its debt collection vendors in 2019. The agreement requires Labcorp to pay $2,287,455 and implement comprehensive changes to its vendor oversight practices. The settlement resolves potential claims under state consumer protection, privacy and breach notification laws, as well as HIPAA regulations.
The settlement, styled as an Assurance of Voluntary Compliance and treated as an Assurance of Discontinuance, does not require Labcorp to admit liability or wrongdoing. However, it imposes significant injunctive relief measures that will fundamentally change how Labcorp manages its vendors, particularly those handling sensitive health information.
The agreement comes amid growing regulatory scrutiny of how healthcare organizations protect patient data when it's shared with third-party vendors. HIPAA-regulated entities frequently transmit protected health information (PHI) to third parties for treatment, payment and healthcare operations, but are still responsible for maintaining security of that data.
Comprehensive Security Overhaul
Beyond the monetary payment, Labcorp must implement extensive security measures. The company is required to conduct annual reviews and updates of its information security program, including employing a qualified chief information security officer (CISO) to oversee implementation and advise senior leadership.
Labcorp must implement security and privacy awareness training for all personnel handling consumer data and establish specific safeguards including an incident response plan, timely reporting processes for vendor security events, and policies governing PHI collection, use, disclosure and retention.
This settlement holds Labcorp accountable for failing in that duty and requires the company to maintain stronger vendor oversight to prevent this kind of breach from happening again.
Vendor Management Requirements
The settlement imposes a robust vendor risk management program requiring written policies reviewed at least annually, a dedicated vendor risk management team, security assessment tools, and vendor questionnaires. Special attention must be paid to debt collection vendors, with Labcorp required to maintain an inventory of contracts, data handled, and risk ratings.
Labcorp must require debt collectors to implement industry-recognized cybersecurity standards such as the National Institute of Standards and Technology's (NIST) Cybersecurity Framework through business associate agreements or other written contracts. These contracts must specify data security requirements including data segmentation where feasible and minimum necessary disclosures.
The company must also conduct annual risk assessments, penetration testing, and either annual SOC 2 Type 2 Audits or biannual HITRUST CSF Validated Assessments. Within 18 months, Labcorp must obtain an independent assessment of its compliance with the settlement terms.
Labcorp was responsible for vetting and managing that vendor, and we're holding them accountable.
Regulatory Precedent Set
The settlement sends a clear message that organizations cannot outsource their responsibility to protect sensitive data, even when working with third-party vendors. Many of the agreement's obligations will expire five years after the effective date, but the regulatory precedent established is likely to have longer-lasting implications.
Nevada Attorney General Aaron Ford emphasized that companies holding sensitive medical and personal information "cannot outsource" their responsibility to protect it. The settlement offers a practical roadmap for any organization looking to strengthen data protections when relying on vendors.
As healthcare organizations increasingly rely on third-party vendors for various functions, this settlement demonstrates that state attorneys general will hold them accountable for data breaches occurring at those vendors, regardless of where the actual security failure occurred.
Related
