DELAWAREÂ - Attorney General Kathy Jennings announced Thursday that Delaware is part of a 44-state coalition that reached a $2.3 million multistate settlement with Laboratory Corporation of America, known as Labcorp.
The settlement resolves a multistate investigation into a 2019 data breach at Labcorp's debt collector, Retrieval-Masters Creditors Bureau, doing business as American Medical Collection Agency, or AMCA.
According to Jennings' office, the breach potentially exposed the personal information of more than 27.5 million people nationwide, including 10.2 million Labcorp patients. The office says 115,250 of those patients were Delaware residents.
The multistate coalition previously reached a settlement with AMCA in 2021 after the company's bankruptcy petition was dismissed.
While the breach occurred at AMCA, the data involved was sensitive information belonging to Labcorp patients, according to the attorney general's office.
"Companies rely on vendors of all kinds to help them do business. But the responsibility to manage and protect consumers’ sensitive personal information cannot be outsourced," Jennings said.
Under the settlement, Labcorp will pay $2,287,455 to the states. Delaware's share is $30,135.
The settlement also requires Labcorp to make changes to its information security and vendor risk management programs.
Those changes include additional oversight of vendors, requirements for medical debt collectors, cybersecurity standards in contracts and information security assessments.
Labcorp will also hire a third-party assessor to conduct an information security assessment focused on vendor risk management, according to the settlement.
The settlement is separate from a 2021 multistate settlement with AMCA, which included a $21 million suspended payment due to the company's bankruptcy.
Separately, Labcorp has agreed to a $35 million settlement in a related class-action lawsuit, which remains ongoing with other AMCA client covered entities.
