– Attorney General Anthony G. Brown announced that Maryland, as part of a bipartisan coalition of 44 attorneys general, has reached a $2.3 million multistate settlement with the Laboratory Corporation of America (Labcorp) resolving an investigation into the 2019 data breach at Labcorp’s debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency (AMCA). The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients of which 451,558 are Maryland residents. The multistate coalition previously settled with AMCA in 2021.
Although the data breach occurred at AMCA, the sensitive data involved was collected by Labcorp and belonged to Labcorp’s patients. Vendor management remains one of the most challenging areas in cybersecurity, but it is critical that businesses properly vet their vendors and ensure that information shared with those vendors will be kept secure. While companies can contract with vendors freely and delegate authority, they still have a duty to maintain the data they collect securely.
“Marylanders trust healthcare companies to protect their most sensitive medical information, even when that information is shared with outside vendors,” said Attorney General Brown. “This settlement holds Labcorp accountable for failing in that duty and requires the company to maintain stronger vendor oversight to prevent this kind of breach from happening again.”…