Labcorp, the nation's largest clinical laboratory network, must implement new rules for how it shares patient financial data with medical debt collectors. Forty-four state attorneys general reached a settlement with Labcorp on September 24, 2026, requiring the company to pay $2,287,455 in total restitution to the states.
The settlement does not reverse the 2019 exposure or offer blanket compensation to every affected person. Instead, it creates structural protections intended to prevent future breaches—requiring debt collectors to segment patient data, follow strict cybersecurity standards, and submit to audits. Labcorp also faces a separate $35 million federal class-action settlement with affected consumers.
Official resources:
- Explore the official data from Ct — Use this primary source to review the underlying data.
- Explore the official data from Ny — Use this primary source to review the underlying data.
Table of Contents
- The 2019 AMCA Breach and Its Scale
- New Rules for Data Sharing With Debt Collectors
- How Labcorp Will Monitor Vendors
- What the Settlement Does and Does Not Offer
- Why Vendor Accountability Matters for Medical Debt
The 2019 AMCA Breach and Its Scale
In August 2018, a hacker breached American medical Collection Agency (AMCA), Labcorp's debt collection vendor, and remained undetected for nearly a year. The 2019 breach ultimately exposed sensitive data on 27.5 million people nationwide, including 10.2 million Labcorp patients, according to the New York Attorney General.
Exposed information included names, Social Security numbers, diagnostic codes, and financial records. AMCA's own systems did not identify the breach; banks processing AMCA payments discovered it. AMCA filed for bankruptcy weeks after discovering the breach and ceased operations, leaving no entity to hold accountable for the exposure. The settlement with Labcorp holds the company responsible instead.
New Rules for Data Sharing With Debt Collectors
Labcorp must now enforce strict limits on what it shares with medical debt collectors. Under the settlement, debt collectors must segment data they pool from multiple clients, keeping Labcorp patient records separate from other healthcare providers' data, according to the Maryland Attorney General. This separation contains risk: if one debt collector is compromised, only Labcorp's patients' data is exposed, not thousands of other providers' records.
Labcorp must also limit the personal and health data it shares with debt collectors to only what is legally required for billing and collections, according to the Colorado Attorney General. Debt collectors will no longer receive full health histories or unnecessary details. The company must implement an incident-response plan covering vendor security breaches so it can respond quickly if another vendor is compromised.
How Labcorp Will Monitor Vendors
The settlement requires Labcorp to establish structural oversight. The company must establish a dedicated vendor risk management team with continuous compliance auditing tools and hire an independent third-party assessor to review its information security program with particular focus on vendor management, according to the Connecticut Attorney General.
Labcorp must contractually impose cybersecurity standards on debt collectors and require them to perform risk assessments and audits of their own security controls, according to the New Jersey Attorney General. Vendors cannot claim they lack resources or expertise to protect data; they must demonstrate it through audits, and Labcorp must verify it. This pushes accountability down the supply chain.
What the Settlement Does and Does Not Offer
The settlement establishes a critical principle: healthcare companies cannot outsource their data security responsibilities; state officials stressed that a company contracting with vendors remains responsible for protecting patient data. If your data is breached by a debt collector Labcorp hired, Labcorp is liable—not just the vendor. The settlements do not identify every person whose data was accessed or undo the 2019 exposure.
If your information was among the 10.2 million Labcorp records exposed, credit monitoring or identity protection from the settlement is the practical remedy available. The state restitution and the federal class settlement operate separately; check with your state's attorney general or the settlement administrator for eligibility and how to submit a claim.
Why Vendor Accountability Matters for Medical Debt
Medical debt collectors handle extremely sensitive information: diagnoses, treatment history, ability to pay, and often Social Security numbers. For years, healthcare providers could hire vendors and hand over millions of records with no legal requirement that vendors meet any security standard. Liability fell only on the vendor, not the company that hired them. This settlement does not guarantee another breach cannot happen.
It establishes that vendors must meet specific cybersecurity requirements, that healthcare providers must verify those standards are met, and that providers remain liable if vendors they hire fail to protect data. For readers with medical debt: knowing that Labcorp must now contractually require its vendors to meet security standards, and that Labcorp faces penalties if they do not, may matter more than the settlement money itself.