North Carolina’s attorney general Jeff Jackson has announced that he and 44 other attorneys general have reached a $2.3 million settlement with Burlington-based Lab-Corp over a data breach that occurred in 2019.
According to Jackson’s office, this particular data breach concerned millions of customer records maintained by the American Medical Collection Agency (AMCA), which serves as the debt collector for LabCorp. This incident reportedly compromised the personal data of 10.2 million patients, including 508,111 residents of North Carolina.
Although the data breach occurred at LabCorp’s collection agency, Jackson insists that the responsibility for securing these records ultimately rested with the Burlington-based medical testing behemoth.
“North Carolina trusted Labcorp with their personal health information, and Labcorp had a responsibility to protect it,” he declared in a statement last month. “That responsibility doesn’t go away when a company works with a third-party vendor.”
With this assumption in mind, Jackson and his fellow attorneys general have compelled LabCorp to pay $2,287,455 to rectify the collection agency’s mishap – with $100,427 of that sum slated to go to North Carolina.
The company has also agreed to implement an information security program, limit the amount of patient information it shares with its vendors, expand vendor management, set security standards for debt collectors in particular, and hire a third-party assessor to review its information security.
