Laboratory Corporation of America (Labcorp) has decided to pay $2,287,455 to resolve a multistate investigation into a data breach in 2019 that involved its debt collection firm, American Medical Collection Agency (AMCA).
A group of 44 state attorneys general investigated Labcorp in relation to the AMCA data breach. The total settlement fund will be divided among the 44 states taking part in the action.
The attorneys general of Connecticut, Indiana, Illinois, Florida, Michigan, and Texas led the investigation. The investigation determined likely violations of the Health Insurance Portability and Accountability Act (HIPAA) and state consumer protection and breach notification regulations.
Labcorp is located in Burlington, NC.
AMCA Data Breach
AMCA provides healthcare organizations, including laboratories and medical testing facilities, with small debt collection services. AMCA is a subsidiary of Retrieval-Masters Creditors Bureau (RMCB).
RMCB discovered the hacking incident on March 19, 2029. According to forensic investigation, the hacker had breached the AMCA network for about eight months before detecting the attack.
The hacker accessed the system from August 1, 2018 to March 30, 2019. Information accessed and stolen from the system included names, private information, financial data, medical test results, diagnostic codes, and Social Security numbers.
The AMCA breach impacted over 27.5 million individuals, which include the 10.2 million Labcorp patients. This was 2019’s biggest data breach reported by a HIPAA-covered entity. As a result, AMCA filed for bankruptcy.
Labcorp Settlement Terms
The Labcorp settlement consists of a financial penalty and injunctive relief. Labcorp must make sure that it doesn’t misrepresent the scope it maintains to protect the privacy, security, and confidentiality of personal data and PHI.
Labcorp should review, modify, and update its info security software. It should likewise use an executive or officer as a Chief Information Security Officer to supervise execution and maintenance of the program.
The settlement calls for security awareness training for all employees who have entry to or accountability for personal data or PHI.
Labcorp needs to use an incident response plan including what to do in case of vendor security incidents. It must also set up procedures for reporting vendor security occurrences internally to senior management.
The settlement requires policies and procedures regulating the selection, use, disclosure, and storage of personal ID and PHI. Those policies must include certain requirements for data shared with debt collectors.
Labcorp have to minimize the personal information and PHI shared with debt collectors.
Vendor Risk Management Conditions
Labcorp should create, implement, and sustain a vendor risk management program and keep a vendor risk management team.
The company need to use security assessment and management resources for vendor assessment and tracking, with specific requirements for debt collectors.
All debt collectors should perform risk analysis. Labcorp should also contractually require debt collectors to perform penetration tests of systems that contain personal data and PHI and twelve-monthly SOC 2 Type 2 audits.
Labcorp must employ a third-party assessor to carry out an information security assessment targeting vendor risk management.
Relevant AMCA Proceedings
AMCA was likewise investigated by the multistate group headed by the Indiana, Connecticut, Texas, and New York attorneys general. AMCA acquired permission from the bankruptcy court to resolve the multistate action and filed a dismissal of the bankruptcy on December 9, 2020.
The AMCA settlement required the firm to create, implement, and keep an information security program. It likewise needed an incident response plan and the designation of a competent Chief Information Security Officer. A $21 million financial penalty was revoked due to the company’s financial position.
Labcorp was also referred to as as a defendant in class action litigation against AMCA and other AMCA clients. Labcorp consented to a $35,000,000 settlement at the beginning of this year. The class action lawsuit is still ongoing versus other AMCA clients.