Labcorp Must Overhaul How It Shares Patient Data With Debt Collectors
Labcorp has agreed to rebuild the way it hands patient records to outside debt collectors, under a settlement with 44 attorneys general announced Sept. 24, 2026. The medical testing company will also pay $2,287,455 to the states.
The New York attorney general's office, which published the terms, said Labcorp must minimize the data it shares with vendors and enforce cybersecurity standards through their contracts. The requirement allows for what debt collectors need to meet their own legal obligations.
Records that debt collectors often pool together for several clients at once must be kept separate. Collectors will have to perform their own assessments and audits, and their contracts must give Labcorp the right to end them for non-compliance.
Labcorp also has to improve its own information security program and develop an incident response plan that covers internal reporting of vendor breaches. It must expand its vendor risk management program with a dedicated team and tools for evaluating vendors, and hire an outside assessor to review how it manages that risk.
The settlement resolves the coalition's investigation into a breach at American Medical Collection Agency, a New York firm that collects small-balance medical debt for laboratories and medical testing facilities. The release presents the payment and the required changes as the outcome of that investigation, and records no admission of wrongdoing by Labcorp.
According to the release, the breach potentially exposed the personal information of more than 27.5 million people nationwide, 10.2 million of them Labcorp patients. The data included Social Security numbers, payment card information, and the names of medical tests and diagnostic codes. A hacker had access to the collector's internal system between August 2018 and March 2019, and the agency failed to detect the intrusion despite repeated warnings from the banks that processed its payments.
"Corporations have a responsibility to protect their customers' private data, especially sensitive medical information," said New York Attorney General Letitia James.
The new payment supplements a settlement the same coalition reached with the collection agency in 2021, which included a $21 million payment suspended because of the company's bankruptcy.
